Linux kernel gets a fix for a flaw that enabled attackers to escape VMs
Linux patched CVE-2026-99999, a networking flaw researchers used to escape VMs to the host.
Paulos Yibelo disclosed PwnEscape, CVE-2026-99999, a Linux kernel networking flaw that lets guest-controlled checksum metadata rewrite an IPv4 header after the kernel has processed it. On his own KVM and Firecracker systems matching Vercel Sandbox, he chained a memory leak to run a host-root helper. Vercel said no customer data access was reported. Fixes cover stable branches 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, and 7.2, plus mainline commit 6785011f8b16.
- CVE-2026-99999 abuses deferred checksum writes into the IPv4 header.
- A lab chain achieved host execution on KVM and Firecracker.
- Vercel reported no access to Sandbox customer data.
- Upstream checks block the write; public exploits are still expected.
Vulnerabilities mentionedAll →
- CVE-2026-999999.3—Linux kernel IPv4 checksum metadata can corrupt headerspublished · Linux kernel (IPv4 stack)
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-99999 | Linux kernel IPv4 checksum metadata can corrupt headers A flaw in the Linux kernel IPv4 stack allows a packet that already carries bad checksum metadata to reach skb_checksum_help, which can corrupt the network header. It is triggered when such a packet is inside the IPv4 path; the published change validates checksum_start before the checksum is completed as defense in depth, and the note says fuller validation on input is still forthcoming. The kernel description limits the effect to header corruption and related mischief, while the CVSS 3.1 score of 9.3 rates a local, unprivileged attack with changed scope and high confidentiality, integrity, and availability impact. Linux systems whose kernels include the unfixed IPv4 checksum-completion path are in scope, but affected version ranges are not listed. It is not in the CISA KEV catalog and no public proof-of-concept is known. |
Full article626 words · extracted from csoonline.com · click to collapse
The Linux kernel’s networking stack was found vulnerable to a guest-to-host escape attack, in which an attacker operating inside a virtual machine (VM) could cross the isolation boundary and access the underlying host.
Dubbed PwnEscape and tracked as CVE-2026-99999, a flaw allowed guest-controlled packet metadata to trigger a write that changes an IPv4 header after the kernel has already processed it. That flaw could be chained with additional exploitation techniques to achieve host-level code execution.
The problem was discovered by security researcher Paulos Yibelo of Pwn.ai while participating in Vercel’s $1 million Sandbox security challenge, announced on August 18. The challenge invited researchers to test the isolation boundaries of Vercel’s sandboxing infrastructure, including whether they could escape the virtual machine itself and reach the host.
Vercel subsequently described PwnEscape as the most severe finding submitted through its program. “The packet-related crash and code execution attacks were demonstrated on the researcher’s own KVM and Firecracker machines matching Vercel Sandbox configuration,” Vercel’s principal security engineer Andy Riancho said in a blog post. No reports showed anyone accessing customer data in Vercel Sandbox, he added.
The issue is now resolved. An NVD description of the bug identified seven stable-branch fixes, including Linux versions 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, and 7.2, and one mainline fix.
Delayed checksum changed kernel-trusted header
PwnEscape exploits Linux’s checksum-offloading mechanism, which allows the kernel to defer calculating a network packet’s checksum until a later stage of processing. The packet’s metadata specifies where the calculation should begin and where its result should be written.
The problem arises when attacker-controlled checksum metadata directs that write into the packet’s IPv4 header. Linux initially processes the packet using its original header, but a later checksum-completion operation can change the header before fragmentation code consumes it again.
Yibelo demonstrated this by successfully changing the IPv4 header’s interpreted length from 20 bytes to 60 bytes. The fragmented code then treated bytes beyond the packet’s valid data as part of the header, allowing 32 bytes of adjacent host memory to be included in an outgoing packet.
This is effectively a time-of-check/time-of-use (TOCTOU) problem: the kernel makes security-relevant decisions using one version of the header, then later acts on a modified version without revalidating it. However, the sequence does not require the usual race between threads; the deferred write occurs during normal networking operations, Yibelo said in a blog post.
Linux’s fix guards the checksum write
The accepted upstream fix, commit 6785011f8b16, introduces validation checks before the relevant checksum-completion operations. These checks prevent the checksum write from corrupting the IPv4 header along the affected processing paths.
The patch was applied to the Linux development tree on October 8 and merged into the mainline kernel on October 14, according to the blog post. Yibelo described the change as a defence-in-depth measure, noting that broader validation of untrusted checksum metadata remains an area for further work.
Yibelo reported chaining the memory leak with additional exploitation steps to achieve selected kernel-memory writes and execute a host-root helper on its own test systems. “We used the resulting capability in a bounded lab chain to execute a host-root helper and return a host-generated marker to the guest. Four separate true-cold boots completed that chain,” he said.
While further details of how Yibelo achieved the guest-to-host escape are awaited, he stressed that the issue is not specific to KVM or another hypervisor, but lies in the Linux networking stack that handles guest traffic.
“Although we suspect the security industry will use this post to figure out the other affected hypervisors and we expect exploits in weaker configurations to arrive in weeks, and exploits working in default hypervisor configurations to arrive in under a month,” Yibelo warned.