PwnEscape CVE-2026-99999: Linux kernel flaw rated 9.3 enables VM escape

Researcher Paulos Yibelo of pwn.ai found CVE-2026-99999 in the Linux kernel's IPv4 checksum offload handling: a guest over virtio-net/TAP supplies crafted csum metadata, and the host kernel writes out of bounds, rewriting an already-validated IPv4 header. CVE.org scores it 9.3 and Red Hat 8.8; the fix, commit 6785011f8b16, landed October 8 and was disclosed October 15. No public exploit or in-the-wild use is known, and AWS says EC2, Lambda and Fargate are unaffected.

• Affected: KVM hosts on unpatched kernels 4.4–6.18 using virtio-net/TAP
• Crafted csum_start turns a 20-byte IPv4 header into a 60-byte one
• Lab demo achieved host memory disclosure and root code execution
• Fix is commit 6785011f8b16; patch hosts before guests