Critical Linux Kernel Flaw Enables Guest-to-Host Escape in Controlled Tests
Summary
CVE-2026-99999 (PwnEscape) lets guest-controlled packets disclose host memory and may enable host compromise. Root execution was demonstrated only in researchers’ lab; update and reboot affected host kernels.
Key points
- The flaw is in Linux IPv4 packet processing and stems from insufficient validation of checksum metadata before deferred checksum completion.
- Researchers demonstrated repeated 32-byte host-memory disclosures using crafted guest-originated packets; Vercel production testing demonstrated disclosure, not root compromise.
- Host-kernel writes and root-level execution were demonstrated only on researcher-controlled systems. Vercel reported no evidence of customer data exposure, and no malicious in-the-wild exploitation is publicly known.
- The issue affects hosts running vulnerable kernels, especially those serving untrusted or multi-tenant guest workloads; updating guest kernels alone does not fix the host exposure.
- Upstream fixes are listed for Linux stable branches from 5.10 through 7.2 and mainline 7.3-rc7; distribution backports may use different version numbers.
- Install a supported patched host kernel and reboot into it; verify the active kernel across all virtualization hosts. Isolation controls can reduce impact but do not replace patching.
- Detection guidance emphasizes correlating guest network activity with host crashes, anomalous IPv4 fragmentation, memory exposure, or unexpected virtualization behavior; no campaign-specific IOCs are identified.
Article Details
- Vulnerability Types
- Improper validation of checksum metadata in Linux IPv4 packet processing, allowing a deferred checksum operation to modify an already-processed IPv4 header
- Severity
- Critical; CVSS 3.1 score 9.3
- Affected Versions
- Linux kernel versions dating back to 2.6.27 that lack the fix or a distribution backport
- Exploitation Status
- not_reported
- Exploit Availability
- public_poc
- Patch Status
- available
CVE
People
Vendors
Products
FirecrackerThe vulnerability does not originate in KVM, Firecracker, or a specific cloud platform.KVMThe vulnerability does not originate in KVM, Firecracker, or a specific cloud platform.LinuxA critical Linux kernel vulnerability tracked as CVE-2026-99999, dubbed PwnEscape, can break the isolation boundary between virtual machines and their underlying hosts.
Industries
CI/CD platformscarries a CVSS 3.1 score of 9.3 and is particularly relevant to cloud providers, sandbox operators, CI/CD platforms, malware-analysis environments, and other organizations that execute untrusted workloads insideCloud providersThe vulnerability carries a CVSS 3.1 score of 9.3 and is particularly relevant to cloud providers, sandbox operators, CI/CD platforms, malware-analysis environments, and other organizations that execute untrustedMalware-analysis environmentsof 9.3 and is particularly relevant to cloud providers, sandbox operators, CI/CD platforms, malware-analysis environments, and other organizations that execute untrusted workloads inside Linux-based virtual machines.Sandbox operatorsThe vulnerability carries a CVSS 3.1 score of 9.3 and is particularly relevant to cloud providers, sandbox operators, CI/CD platforms, malware-analysis environments, and other organizations that execute untrusted