Linux KVM guest-host escape rated critical, may represent a new way to attack penguin-powered networking

Party like it’s CVE-2026-99999 – a 9.3-rated nasty called PwnEscape.

The short version

• Yibelo’s work is now CVE-2026-99999 .
• It is a scary bug because it makes a guest-host escape possible with a few malformed IPv4 packets.
• PwnEscape makes it possible for guests to access the host, by sending a guest malformed IPv4 packets.

What happened

As explained in a message from Red Hatter Michael S. Tsirkin in the Linux kernel stable tree, ‘If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief.” Analysis from threat-finding firm SOC Prime details the mischief.

Why it matters

“Linux allows network packets to carry metadata indicating where a checksum operation should begin and where its result should be written.

Summary by Nerd News Network. Read the full article at The Register — Networks via the links above and below.