linux kernel: PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999)
A write-up claims Linux KVM guest-to-host escape CVE-2026-99999, so far described as host-memory disclosure.
An oss-security note points to a PwnEscape disclosure of CVE-2026-99999, presented as a Linux KVM guest-to-host escape. The available description characterizes the issue as host-memory disclosure, with a more detailed follow-up said to come later. The post also references earlier discussion on the netdev mailing list. No in-the-wild exploitation is stated.
- Tracked as CVE-2026-99999 against Linux KVM.
- Current write-up describes host-memory disclosure.
- A fuller guest-to-host escape write-up is expected later.
- Earlier discussion occurred on the netdev mailing list.
Vulnerabilities mentionedAll →
- CVE-2026-999999.3—Linux kernel IPv4 checksum metadata can corrupt headerspublished · Linux kernel (IPv4 stack)
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-99999 | Linux kernel IPv4 checksum metadata can corrupt headers A flaw in the Linux kernel IPv4 stack allows a packet that already carries bad checksum metadata to reach skb_checksum_help, which can corrupt the network header. It is triggered when such a packet is inside the IPv4 path; the published change validates checksum_start before the checksum is completed as defense in depth, and the note says fuller validation on input is still forthcoming. The kernel description limits the effect to header corruption and related mischief, while the CVSS 3.1 score of 9.3 rates a local, unprivileged attack with changed scope and high confidentiality, integrity, and availability impact. Linux systems whose kernels include the unfixed IPv4 checksum-completion path are in scope, but affected version ranges are not listed. It is not in the CISA KEV catalog and no public proof-of-concept is known. |
Posted by Jan Schaumann on Oct 15 The existence of this vulnerability was disclosed a https://pwn.ai/blog/pwnescape This describes a host-memory disclosure and is phrased as a guest-to-host escape, although a second part going into more details of that is supposed to come later, it sounds like. There was some discussion on the netdev mailing list prior to this write-up and disclosure:...
This source does not provide full text. Read it at seclists.org.