New Linux kernels fix CVE-2026-99999, a reported guest-to-host KVM escape

New Linux stable releases include a fix for a critical vulnerability in the kernel's networking stack that researchers say can be used to cross the boundary between a virtual machine guest and its host — a "KVM escape". The flaw, tracked as CVE-2026-99999, is in IPv4 checksum handling rather than in KVM itself.

What's happening

According to LWN.net, Greg Kroah-Hartman has announced the release of the 7.2.11, 6.18.57, 6.12.113, 6.6.159, 6.1.190, 5.15.223 and 5.10.272 stable kernels, and the series includes a fix for the critical CVE-2026-99999. LWN quotes patch author Michael S. Tsirkin describing the flaw in skb_checksum_help() as one that would let an IPv4 packet with bad checksum metadata "corrupt the network header and cause a bunch of mischief". As usual, LWN says, all users are advised to upgrade.

The researchers who found and reported it, pwn.ai, have published a detailed write-up titled "PwnEscape". They explain that the bug lives in Linux networking, not in the hypervisor: guest-controlled checksum metadata could rewrite an IPv4 header after the kernel had already validated and acted on it. In their words, the issue is a "deferred-metadata trust inversion", where an asynchronous checksum-completion step (the normal CHECKSUM_PARTIAL mechanism) writes into bytes that had already been parsed as an IPv4 header inside ip_do_fragment().

The research began during a $1 million sandbox research challenge that Vercel announced on August 18, 2026. According to pwn.ai, they developed the primitive within three days, reported an initial bounded host-memory disclosure on August 20, and reported the kernel root cause privately on September 4; Tsirkin reportedly reproduced it on September 7. Vercel later described it as the program's most important report.

What started as an apparent 32-byte host-memory disclosure became, in the researchers' own KVM test setup, a full guest-to-host escape: they demonstrated selected 64-byte host-kernel writes and, in a bounded lab chain, executed a host-root helper and returned a host-generated marker to the guest across four cold boots. They emphasise that this was proven on their own infrastructure, and is not a claim of root code execution in any vendor's production environment. They also expect working exploits to appear — in weaker configurations within weeks, and in default hypervisor configurations within under a month — describing that as their expectation, not a confirmed fact.

The accepted upstream fix is commit 6785011f8b16, "ipv4: validate checksum_start before completing checksum". pwn.ai reports the patch was applied to net.git on October 8, 2026 and merged into mainline on October 14, 2026, with stable backports arriving afterwards. The fix is described as defence in depth: a narrow IPv4 guard rather than a full redesign, with broader ingress validation noted as future work.

Who's affected

Cloud and hosting providers, and anyone running multi-tenant virtual machines or sandboxes on affected Linux kernels, since the reported impact crosses the guest/host boundary.
KVM-based environments and, per the researchers, "many other hypervisor environments"; the discussion also considered TUN and AF_PACKET scenarios that do not involve a VM.
Distributions and vendors shipping stable Linux kernels, which need to backport the fix.
Ordinary users generally are encouraged to keep their kernel up to date, though the boundary crossing is primarily a virtualisation and multi-tenancy concern.

What to do

Upgrade to a fixed kernel. The stable releases containing the fix are 7.2.11, 6.18.57, 6.12.113, 6.6.159, 6.1.190, 5.15.223 and 5.10.272.
If you operate virtualisation or sandboxes, prioritise this. The reported attack crosses a trust boundary, so treat it as higher risk than an ordinary kernel bug.
Follow your distribution's advisory. Distro kernels receive the fix via their own backports; check the current live kernel records and vendor advisories for status.
No workaround is described. The primary mitigation is to apply the fix. This is an evolving situation, and CVE publication and backport status should be verified against official sources.

Sources

LWN.net — reports the stable kernel releases, the fix for CVE-2026-99999 and Tsirkin's description of the checksum flaw.
pwn.ai — the researchers' write-up of the "PwnEscape" guest-to-host escape, the affected mechanics and the disclosure timeline.
Linux kernel (upstream commit) — the accepted fix, "ipv4: validate checksum_start before completing checksum".