CVE-2026-99999

Published Oct 15, 2026

Last updated a day ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-99999, also known as "PwnEscape," is a guest-to-host virtual machine (VM) escape vulnerability residing in the Linux kernel's IPv4 networking stack. The flaw stems from improper validation of checksum metadata (specifically the `csum_start` field) provided by a guest VM via paravirtualized network devices like virtio-net. When a guest sends a packet with malformed checksum metadata, the host kernel's checksum helper function (`skb_checksum_help`) writes two attacker-controlled bytes into the IPv4 header after the kernel has already validated and processed it. This causes the host's IP fragmentation code to misinterpret the packet's header length, allowing the guest to manipulate host memory. Exploiting this vulnerability allows an attacker with control over a guest VM to trigger a repeatable leak of host kernel memory, crash the host system, or execute arbitrary code as root on the host. The vulnerability affects the Linux kernel's IPv4 networking subsystem and dates back to kernel version 2.6.27, impacting numerous Linux distributions that run virtualized workloads. Security updates and patches are being prepared and released by various Linux distributions to address the issue.

Description: In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
NVD status: Received

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.3
Impact score: 6
Exploitability score: 2.5
Vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 6

References

Sources include official advisories and independent security research.

Overview

AI description

Risk scores

CVSS 3.1

Social media

References