Virtual machines rest on one promise: whatever runs inside the guest stays inside the guest. A newly disclosed Linux kernel flaw breaks that promise in an unusual place. The problem is not in the hypervisor's device emulation or a graphics driver. It is in the ordinary IPv4 networking code that handles packets every Linux host processes.
The bug is tracked as CVE-2026-99999, and researcher Paulos Yibelo of pwn.ai has named it PwnEscape. The National Vulnerability Database record, published October 15, carries a CVSS v3.1 score of 9.3 (Critical). That score is a secondary rating supplied by the CVE Numbering Authority. NVD lists the record's status as "Received," which means NIST has not yet done its own analysis. The vector in the record is local: the attacker must already be running code in a guest, so this is not a flaw an outsider can exploit across the open internet.
What the bug actually is
The kernel's own description of the fix is short: "ipv4: validate checksum_start before completing checksum."
Some background. Every network packet carries checksums so that corrupted data can be detected. Computing them costs CPU time, so Linux often puts the job off. A packet can travel through the stack with checksum metadata attached, which is a note saying where in the packet the checksum calculation should start and where the result should be written. When the checksum finally has to be calculated in software, a kernel helper function called skb_checksum_help follows those instructions.
According to the NVD description, a packet whose checksum metadata is bad can reach the IPv4 stack and cause skb_checksum_help to corrupt the packet's network header. In a virtualized setup, a guest VM controls that metadata. Analysis from SOC Prime, cited by The Register, puts it this way: guest-controlled metadata can influence a write that happens after the header has already passed earlier validation stages. The kernel checks the header and then lets the guest's instructions change it.
The Register reports that a few malformed IPv4 packets are enough to make a KVM guest-to-host escape possible.
What was demonstrated, and where
The demonstrations fall into two groups, and they should be kept apart.
In production: According to The Hacker News, Yibelo found the flaw during a Vercel security challenge and reported it privately. Vercel said the memory leak was demonstrated against its production sandboxes, where each packet sent from a guest could carry back about 32 bytes of host memory. Vercel confirmed the leak. It also said that no report in the challenge showed any customer files, secrets or application data had been read.
In the lab: Two crafted packets crashed a lab host, taking down every sandbox running on it, and the researcher reached administrative control of a lab host. Those results were observed only on the researcher's own machines, which were set up to match Vercel's. The Hacker News quotes Yibelo as saying this is "not a claim of root command execution in any vendor's production environment."
Red Hat's assessment, as reported by The Register, says the impact can include arbitrary code execution on the host, denial of service, or disclosure of sensitive memory. The Hacker News reports no sign of use in a real attack and notes the flaw is not in CISA's catalog of actively exploited vulnerabilities.
Thirty-two bytes per packet sounds small. But the guest can keep sending packets, and SOC Prime, as quoted by The Register, notes that because the disclosure can be triggered repeatedly, a guest workload could potentially collect information from a security domain the virtual machine should not be able to inspect. In a multi-tenant environment, the host's memory can also hold data from other tenants.
Why researchers think it matters beyond one patch
Yibelo argues, per The Register, that PwnEscape exposes a new class of Linux networking attacks rather than a single mistake. The general idea is that metadata travelling alongside a packet may be trusted by code that never expected a hostile guest to control it. The Register's headline describes it as possibly "a new way to attack penguin-powered networking." That is the researcher's reading so far, not an established finding. Still, it is a reason to expect follow-up work in this area.
The kernel developers seem to agree that the current fix is not the end of the story. The NVD text says the issue was discovered and reported by Paulos, reproduced independently by others, and that "a more complete validation at input is forthcoming, but needs more work." The Register attributes the kernel stable-tree message to Red Hat's Michael S. Tsirkin.
What It Means for Defenders
Who is affected: Anyone running Linux hosts that carry guest VMs, with KVM being the case the reporting describes. The highest-risk setups are those where the guests are untrusted: cloud and hosting providers, sandboxing and CI platforms, VDI farms, and internal labs that run customer or third-party workloads. If everyone who can run code in your VMs already has admin rights on the host, the risk is lower. It is still not zero, because a compromised guest is an untrusted guest. The Register reports that AWS says its EC2 service is not at risk.
What to patch: The fix has landed in the Linux kernel stable tree, and the NVD record links eight separate stable-branch commits. The record lists these as the first unaffected versions per branch: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, 7.2.11 and 7.3. Distributions often backport fixes without changing the version number, so check your distribution's security advisory for kernel packages that include the "ipv4: validate checksum_start" fix, rather than relying on the version string alone. Install them on virtualization hosts first, and reboot. A kernel fix does not protect you until the patched kernel is actually running, and, per The Hacker News, updating only a guest's kernel does not fix the host.
Plan for a second round: The developers say a more complete input-validation fix is still on the way. Treat this as the first of possibly two or more kernel updates. Do not mark the ticket closed after the first one.
Prioritize: Patch multi-tenant and internet-facing virtualization hosts before single-tenant boxes. If a host cannot be patched quickly, think about whether it should keep running untrusted guests until it is. The sources do not describe any configuration workaround. Patching is the only mitigation they give.
Check and rotate: No exploitation has been reported, and Vercel says no customer data was shown to have been read. If you operate shared hosts that ran untrusted guests before patching and you have reason for concern, review host stability logs for unexplained crashes. Also consider which host-resident secrets would matter if memory were exposed. That is a judgment call, not something the sources recommend.
For CMMC and federal contractors: If CUI is processed on virtualized Linux infrastructure, record this CVE in your vulnerability-management and flaw-remediation records along with the patch date. A critical-rated guest-to-host isolation flaw is the kind of item an assessor would reasonably expect to see tracked.
