CVE-2026-99999

CRITICAL

In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.

CVSS v3.1 Score

9.3
CRITICAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack Vector
LOCAL
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Published: 10/15/2026Modified: 10/19/2026

Related Intelligence (5)

CRITICALAi

KVM escape exposes broader attack surface in Linux networking

Security researchers have found a critical flaw in the Linux kernel’s networking stack that can let attackers escape a KVM virtual machine and execute code on the host system. The weakness could also potentially let attackers compromise systems running other Linux-based virtualization and sandbox platforms. Tracked as CVE-2026-99999 and dubbed PwnEscape , the vulnerability was discovered by resear

CVE-2026-99999
CSO Online
LOWVulnerability

Linux kernel gets a fix for a flaw that enabled attackers to escape VMs

The Linux kernel’s networking stack was found vulnerable to a guest-to-host escape attack , in which an attacker operating inside a virtual machine (VM) could cross the isolation boundary and access the underlying host. Dubbed PwnEscape and tracked as CVE-2026-99999, a flaw allowed guest-controlled packet metadata to trigger a write that changes an IPv4 header after the kernel has already processe

CVE-2026-99999
CSO Online
MEDIUMVulnerability

PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999)

[object Object]

CVE-2026-99999
r/netsec
CRITICALVulnerability

Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory

A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it. The flaw, now tracked as CVE-2026-99999 and nicknamed PwnEscape, is in the Linux kernel's networking code, not in any one cloud's setup, so it reaches the shared

CVE-2026-99999
The Hacker News
LOWVulnerability

Issue in the Linux kernel virtio-net/TAP networking path affecting KVM-based hypervisors

<p><b>Bulletin ID:</b> 2026-137-AWS <br> <b>Scope:</b> AWS <br> <b>Content Type:</b> Important (requires attention) <br> <b>Publication Date:</b> 10/15/2026 10:30 AM PDT</p> <p><b>Description:</b></p> <p>AWS is aware of an issue in the Linux kernel's virtio-net/TAP networking path (CVE-2026-99999) that affects KVM-based hypervisors running unpatched Linux kernel versions 4.4 through 6.18. This iss

CVE-2026-99999
AWS Security Bulletins

References (11)

https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40ahttps://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbbhttps://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbfhttps://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956https://git.kernel.org/stable/c/a65f69e0f38ffbed1b128029e09097436416dc8bhttps://git.kernel.org/stable/c/c3e33464746166264334641dc850a36eef7e6326https://git.kernel.org/stable/c/f3e835af6226f1dd12160cbd696081e9b6155de0https://pwn.ai/blog/pwnescapehttps://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challengehttp://www.openwall.com/lists/oss-security/2026/10/15/5