A critical Linux kernel networking flaw dubbed PwnEscape lets an attacker inside a virtual machine corrupt host kernel memory and break the guest-to-host isolation boundary, and fixed host kernels are now rolling out across major distributions. The flaw, CVE-2026-99999, received a CVSS v3.1 base score of 9.3 (Critical) in the CVE record published on October 15, 2026.
The bug sits in the kernel’s IPv4 receive path. When a packet carries a malformed checksum_start value, the helper function skb_checksum_help can write out of bounds, corrupting the network header and other kernel memory, Red Hat explained in its advisory, classifying the issue under CWE-787, an out-of-bounds write. Red Hat rates the flaw IMPORTANT with a CVSS 3.1 score of 8.8, differing from the upstream CVE record only on the privileges-required metric.
Security researcher Paulos Yibelo of Pwn.ai discovered the flaw while taking part in Vercel’s $1 million Sandbox security challenge, which since its August 18 launch has invited researchers to test the isolation boundaries of Vercel’s sandboxing infrastructure. Vercel called PwnEscape the most severe finding submitted through the program. According to pwn.ai and CSO Online, the fix was applied to the Linux net.git development tree on October 8 and merged into Linus Torvalds’ mainline tree on October 14.
What was demonstrated
In the Vercel Sandbox environment, the most serious demonstrated impact was host memory disclosure, with each suitable crafted packet leaking roughly 32 bytes of host memory, Vercel and subsequent reporting confirmed. The Hacker News reported that guest-triggered host crashes and host-root code execution were achieved only on the researcher’s own lab systems configured to match Vercel’s stack, not in Vercel production, and that no customer files, secrets or application data were accessed.
As of October 19, PwnEscape has not been linked to real-world attacks and does not appear in CISA’s Known Exploited Vulnerabilities catalog, SecNews and The Hacker News noted. Red Hat internally tracks the flaw as an “active-exploit case,” a designation that appears to reflect the existence of working exploit chains rather than in-the-wild abuse.
Who is affected
The vulnerability affects Linux hosts from roughly kernel version 2.6.27 up to, but not including, the fixed stable releases 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 and 7.2.11, according to NVD. KVM-based hypervisors that rely on the Linux kernel to terminate guest networking — including deployments using virtio-net, TAP, TUN or Firecracker microVMs — are exposed when running unpatched host kernels.
Red Hat says all currently tracked RHEL kernel streams and Red Hat In-Vehicle OS kernels are affected, and an AWS bulletin notes KVM-based hypervisors using Linux 4.4 through 6.18 with virtio-net or TAP paths can be impacted when an actor with privileged guest access sends specially crafted packets. Debian’s Security Tracker references advisories DSA-6568-1 and DLA-4841-1, Ubuntu has issued a security note covering LTS releases from 16.04 through 26.04, and Proxmox says only its 7.0.14 kernel series will receive the fix.
What to do
- Patch the host kernel that terminates guest networking, then reboot or use live-patching where available. Updating only guest operating systems does not remediate the flaw in the host’s networking stack.
- Install a kernel carrying the upstream fix, commit 6785011f8b16 (“ipv4: validate checksum_start before completing checksum”) by Red Hat developer Michael S. Tsirkin, which adds bounds checks before checksum completion and reorders the relevant paths so validation precedes the write.
- Where an immediate reboot is not possible, technical summaries suggest temporarily disabling hardware and software checksum offloading on virtual interfaces, for example with ethtool -K tx-checksum-ip-generic off, to keep untrusted checksum metadata from reaching skb_checksum_help. This is a stop-gap, not a full fix.
Beyond the immediate VM escape, pwn.ai and other analyses describe PwnEscape as exposing a broader class of Linux networking weakness in which untrusted checksum metadata can rewrite security-sensitive packet fields after the kernel has already validated them, undermining assumptions across the networking stack. Upstream commentary has promised more complete validation at input for packets crossing virtual interfaces, but no committed timeline or design has been published, leaving open questions about residual risk in related code paths.
2 Responses