Linux kernel bug CVE-2026-99999 (PwnEscape) lets a guest VM corrupt host memory on KVM

A flaw in how the Linux kernel completes network checksums lets a malicious virtual machine corrupt memory on the host it runs on, and researchers have shown it can be chained into a full guest-to-host escape on KVM. The bug, tracked as CVE-2026-99999 and nicknamed PwnEscape, was found by Paulos Yibelo of the security firm pwn.ai. It matters because the vulnerable code is not in KVM at all but in the host's ordinary IPv4 networking stack, so any setup that lets less-trusted software hand packets to the host kernel, including many sandboxes for AI agents, should check its kernels.

Key points

• CVE-2026-99999 is a Linux kernel IPv4 bug: a guest-controlled "checksum start" value is not validated before the kernel writes a checksum, so the write can land on the wrong bytes (an out-of-bounds write, CWE-787, per Red Hat).
• The CVE.org record rates it 9.3 (critical); Red Hat rates it 8.8 (important) because it counts the attacker as needing low privileges (Red Hat's CVSS 3.1 vector).
• AWS says unpatched kernels from 4.4 through 6.18 on KVM hosts using virtio-net are affected, but that Amazon EC2, Lambda and Fargate are not.
• The upstream fix is the commit "ipv4: validate checksum_start before completing checksum" (6785011f8b16); AWS says there is no workaround other than updating the kernel.
• The researchers report a 32-byte host-memory leak and, in their own lab KVM setup, 64-byte host-kernel writes that ran a helper as host root.

What happened

According to the researchers' own write-up, the work began with a bounty: on 18 August 2026 Vercel announced a US$1 million challenge to break the isolation of its Sandbox product. The pwn.ai team says it found the underlying primitive within three days, and that Vercel later described the report as the programme's most important one and recorded it as the single critical finding in the final tally. That is the researchers' account of Vercel's remarks; we did not find a Vercel statement to confirm it.

The flaw itself sits in how Linux handles "partial" checksums. For efficiency the kernel can carry a packet with its transport checksum still to be filled in, tracking where to start summing (csum_start) and where to store the result (csum_offset). Those values authorise a later write into the packet's memory. In normal traffic they describe the packet that really exists. But a virtual machine's network device, such as virtio-net or a TAP interface, lets the guest supply that metadata. The write-up says a guest could send an IPv4 packet whose checksum metadata pointed somewhere it should not, so that when the host later called the helper skb_checksum_help(), the checksum was written over the IPv4 header after the kernel had already checked that header. The Red Hat Product Security entry describes the same failure: a malformed checksum_start lets the helper write out of bounds and corrupt the network header and other kernel memory.

The kernel commit message, written by Red Hat's Michael S. Tsirkin and reviewed by Google's Willem de Bruijn, is blunt. It says that if a packet with bad checksum metadata gets into the IPv4 stack, the helper "can corrupt the network header and cause a bunch of mischief." It credits Paulos Yibelo with the report and says others have since reproduced it independently. It also says the fix is a defence-in-depth check before the checksum is completed and adds: "A more complete validation at input is forthcoming, but needs more work." In other words, the merged patch is not described as the last word. The commit touches the IPv4 output path and several other places that complete checksums, including netfilter queueing, the bridge connection-tracking code, the CHECKSUM target in iptables and the IPsec (xfrm) output path. Its "Fixes" tags point to the long-standing changes that let TUN devices accept offload headers from user space and that added checksum offload to packet sockets.

AWS published bulletin 2026-137-AWS on 15 October 2026. It describes an issue in the "virtio-net/TAP networking path" affecting KVM-based hypervisors on unpatched kernel versions 4.4 through 6.18, and says an actor with privileged access inside a guest could send crafted packets that corrupt host kernel memory, leading to disclosure of host memory or denial of service. AWS says its managed compute services, including EC2, Lambda and Fargate, are not affected, but that customers who run their own KVM hosts, including with virtual machine monitors such as Firecracker, should update. It lists fixed Amazon Linux kernels, among them 6.1.188, 6.12.110 and 6.18.51 builds on Amazon Linux 2023, and states there are no workarounds.

Background

Escapes from a guest virtual machine to its host are rare and valuable, because the hypervisor boundary is what lets cloud providers run strangers' code side by side. Most past attention has gone to the hypervisor and its device emulation. The pwn.ai team argues that a guest also touches a whole host operating system, including virtual networking, packet filters and memory allocators. This bug is a good illustration: the researchers stress that "KVM escape" names the boundary crossed in their proof, not the file that contained the bug.

The issue also lands in a year of heavy attention on sandboxing. The researchers open their post by pointing to Vercel's August challenge and to a security incident OpenAI disclosed in which AI agents in restricted evaluation environments reportedly got around network isolation. We have not verified that incident and mention it only as the researchers' framing. Separately, The Register reports that Edera, a vendor built on the Xen hypervisor, counts seven KVM escape bugs in 2026 and uses CVE-2026-99999 to argue against KVM's attack surface; that is a vendor's position rather than a neutral finding.

The numbers

Two scores exist for the same flaw, and they differ on one metric. Red Hat's page says the CVE.org record assigns 9.3 (critical, with no privileges required) while Red Hat itself assigns 8.8 (important, low privileges required). Both agree on local attack vector, low complexity, changed scope and high impact on confidentiality, integrity and availability.

CVE.org record9.3

Red Hat (CVSS 3.1)8.8

CVSS base score for CVE-2026-99999 by assessor (score out of 10)

	score out of 10
CVE.org record	9.3
Red Hat (CVSS 3.1)	8.8

Source: Red Hat Customer Portal, CVE-2026-99999

The researchers' own claims are more modest in scale than the headline. They describe a 32-byte host-memory disclosure that the guest can trigger repeatedly. In "an owned KVM fixture", their own test machine, they report building that into selected 64-byte host-kernel writes and, in four separate cold boots, executing a helper as host root. These are lab results from the finders, run on a setup they control; real hosts differ in kernel version, configuration and memory layout, and no independent reproduction of the full escape has been published that we could find.

What it means

For operators of KVM hosts, the practical message is simple: update the host kernel, then reboot. Because the bug is in a core networking path, the relevant question is not "do we use KVM?" but "can untrusted software send packets to this kernel through a TUN/TAP, virtio-net or packet-socket path?" AWS names virtio-net and TAP, and the commit's "Fixes" tags name TUN offload and packet sockets, so container hosts and sandbox platforms that expose those paths deserve a look too. We did not find vendor guidance on non-KVM setups and do not claim any.

For cloud customers on managed services, AWS says no action is needed. For self-managed fleets, distribution kernels are the route: Red Hat says all currently tracked product streams are affected and that fixes are being pursued, so at the time of writing some enterprise users may still be waiting. Red Hat also says no mitigation meeting its criteria is available. Its page labels the flaw a "KEV active-exploit case"; we could not confirm exploitation in the wild from any other source and do not assert it.

For kernel developers, the more interesting point is the researchers' claim, which is theirs and not independently assessed, that untrusted checksum metadata can rewrite security-sensitive packet fields after the kernel has validated them, opening a broader class of bugs. The commit message's promise of fuller validation at input suggests maintainers see more work ahead.

What we don't know yet

• Which distributions have shipped fixed kernels beyond Amazon Linux; Red Hat's fix timeline is not stated.
• Whether the bug has been exploited outside research settings.
• The exact range of affected configurations beyond AWS's description of the virtio-net and TAP path.
• Whether the "more complete validation at input" arrives soon and whether it changes what operators must do.
• We could not open the NVD entry because the site blocked our request, so we have not independently read its score or affected-version fields.

What to watch next

Watch for distribution advisories from Debian, Ubuntu, SUSE and Red Hat, for the follow-up input validation patch on the kernel networking list, and for the second post the pwn.ai team says will cover related network-isolation findings. Sandbox providers that build on Firecracker or similar monitors may also publish their own notices.

Sources

• PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999), pwn.ai
• Linux stable commit "ipv4: validate checksum_start before completing checksum"
• AWS Security Bulletin 2026-137-AWS
• Red Hat Customer Portal: CVE-2026-99999
• The Register: Linux KVM guest-host escape rated critical