Security56 mOctober 18, 2026, 10:04

PwnEscape: guest-to-host KVM escape via Linux checksum processing (CVE-2026-99999)

Researchers at pwn.ai disclosed CVE-2026-99999, a critical Linux kernel flaw in IPv4 checksum handling that lets a guest overwrite validated headers and leak host memory. Linux CNA rates it CVSS 9.3 and Red Hat 8.8; host root code execution was shown only in a researcher-owned KVM setup, while Vercel confirmed a production memory leak with no customer data access.

DEV Community

Open source

PwnEscape: guest-to-host KVM escape via Linux checksum processing (CVE-2026-99999)

CVSS 9.3 (Linux CNA) and 8.8 (Red Hat); affects virtio-net, KVM, Firecracker and Vercel Sandbox
Guest-controlled checksum metadata changes IPv4 header length from 20 to 60 bytes
Vercel confirmed a production host memory leak with no customer data exposure
Host root code execution demonstrated only in researcher test environments

#Linux#KVM#Vercel#Firecracker

Researcher claims full KVM guest-to-host escape flaw

Security

Critical PwnEscape Linux Kernel Flaw Lets Guest VMs Read Host Memory

Security

Repeated VM Escapes By GPT-5.6-Cyber Based Agents Prove VMs and OS' Require Better Maintenance

Security

PwnEscape: guest-to-host KVM escape via Linux checksum processing (CVE-2026-99999)

Researcher claims full KVM guest-to-host escape flaw

Critical PwnEscape Linux Kernel Flaw Lets Guest VMs Read Host Memory

Repeated VM Escapes By GPT-5.6-Cyber Based Agents Prove VMs and OS' Require Better Maintenance

Meta Muse's KVM Escape Flaw Could Have Exposed Internal Infrastructure