Threat reportVulnerabilityTL-2026-3666
PwnEscape (CVE-2026-99999): Linux Kernel IPv4 Checksum-Offload Flaw Lets Guest VMs Read Host Memory
PwnEscape (CVE-2026-99999) (TL-2026-3666), also tracked as PwnEscape, is a critical-severity software vulnerability scored CVSS 9.3, first published 2026-10-15. It has no confirmed attribution, affects Linux Linux kernel (IPv4 output, netfilter, xfrm, bridge; virtio-net, references 1 CVE (CVE-2026-99999), maps to 4 MITRE ATT&CK techniques (T1005, T1059, T1588.005), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 9.3/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-3666
- Threat ID
- TL-2026-3666
- Also known as
- PwnEscape
- Severity
- CRITICAL
- CVSS
- 9.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, cloud services, hosting providers
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in PwnEscape (CVE-2026-99999)
Malware and tooling: Omega-Pwn, OmegaClaw
How PwnEscape (CVE-2026-99999) works
A flaw in the Linux kernel's IPv4 checksum-completion code lets guest-controlled CHECKSUM_PARTIAL metadata rewrite IPv4 header bytes after validation, leaking about 32 bytes of host kernel memory per packet. Paulos Yibelo (pwn.ai) demonstrated the leak against Vercel's production sandboxes during Vercel's $1M Sandbox challenge, and showed host crash and host-root code execution only on researcher-owned lab hosts. No in-the-wild exploitation has been reported and the CVE is not in CISA KEV.
CVE-2026-99999 (dubbed PwnEscape) is a deferred-metadata trust inversion in the Linux kernel host networking stack. Untrusted skb->csum_start and skb->csum_offset values supplied by a guest were not validated against the current network-header context before skb_checksum_help() performed its deferred checksum write. The write could therefore land inside an IPv4 header that the kernel had already parsed and made decisions on. The issue is in the host Linux networking stack, not in the hypervisor itself. NVD records the affected range as Linux 2.6.27 and later, touching IPv4 output, netfilter, xfrm and bridge code, with CVSS 3.1 vector AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (9.3).
The primary entry vector is virtio-net on KVM hosts (__virtio_net_hdr_to_skb()). TUN devices and AF_PACKET sockets are secondary attack surfaces in non-hypervisor contexts. In the lab-demonstrated information-disclosure stage, an attacker inside the guest crafts a fragmented IPv4 packet with CHECKSUM_PARTIAL metadata and sets csum_start so it overlaps link-layer boundaries. The checksum write overwrites the IPv4 ihl field from 0x45 (20-byte header) to 0x4f (60-byte header). ip_do_fragment() then consumes the altered ihl, treats the header as 60 bytes, and copies about 32 bytes beyond the packet's logical linear data into the transmitted fragments, where host kernel memory appears as IPv4 options. Besides skb_checksum_help() and ip_do_fragment(), four more IPv4 checksum-completion consumers are affected.
The researcher reported demonstrating controlled 64-byte host-kernel writes using allocation-sensitive techniques and object-lifetime manipulation on researcher-owned KVM instances. He also reported host-root helper execution on researcher-owned Linux 6.12 and 7.x kernels across four true cold boots. Vercel's report states that the memory leak was shown against production systems, while the crash and code-execution proofs ran on matching test configurations. Vercel Sandbox uses a Firecracker microVM with a dedicated guest kernel per sandbox. Vercel stated that no report showed anyone accessing customer data.
The upstream fix is commit 6785011f8b16 by Michael S. Tsirkin (Red Hat). It adds an ip_check_csum_start() guard across five checksum-completion paths, enforcing csum_start >= network_header + ip_hdrlen(skb), and is described as a defence-in-depth measure. First fixed stable releases are 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 and 7.2.11, with 7.3-rc7 and later also fixed per NVD. The discovery used the researcher's AI-assisted Omega-Pwn harness (SingularityNET OmegaClaw architecture with GPT-5.6 Sol as primary reasoning engine), per The Hacker News. The attack requires code execution inside the guest, so the realistic risk is to multi-tenant sandbox, cloud and virtualization providers running unpatched host kernels.
MITRE ATT&CK techniques used in TL-2026-3666
Collection
Execution
T1059 Command and Scripting Interpreter
Resource Development
T1588.005 Obtain Capabilities: Exploits
Privilege Escalation
Affected products and versions in PwnEscape (CVE-2026-99999)
- Linux — Linux kernel (IPv4 output, netfilter, xfrm, bridge; virtio-net, TUN, AF_PACKET entry points)
Vulnerable versions: 2.6.27 and later, prior to the fixed releases below
Fixed in: 5.10.272; 5.15.223; 6.1.190; 6.6.159; 6.12.113; 6.18.57; 7.2.11; 7.3-rc7
Remediation for PwnEscape (CVE-2026-99999)
Patches
- Upstream commit 6785011f8b16 (adds ip_check_csum_start() across five checksum-completion paths)
- Linux stable: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, 7.2.11; mainline 7.3-rc7 and later
Immediate actions
- Upgrade host kernels to a fixed stable release (5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, 7.2.11 or later) and reboot
- Prioritize multi-tenant KVM / microVM / sandbox hosts that run untrusted guest code
- Hunt for guest-originated fragmented IPv4 packets with unexpected IP options on host-side taps and bridges
Workarounds
- No vendor workaround is documented in the sources; restrict untrusted guest workloads to patched hosts until updated
Longer-term hardening
- Treat guest-supplied virtio-net offload metadata as untrusted and monitor host-kernel crashes and oopses in skb_checksum_help / ip_do_fragment
- Centralize network policy enforcement outside the guest and remove guest-side trust in the control plane, as Vercel did after the challenge
- Keep host kernels on a rapid patch cadence for networking subsystems
CVEs associated with PwnEscape (CVE-2026-99999)
Timeline of PwnEscape (CVE-2026-99999)
- Vercel announces its $1M Sandbox security challenge.
- Paulos Yibelo (pwn.ai) submits the initial disclosure report on day three of the challenge, showing a guest-to-host memory leak against Vercel's production sandboxes.
- Private notification with patches sent to the Linux kernel community.
- Fix accepted upstream into net.git (Oct 7-8) as commit 6785011f8b16 by Michael S. Tsirkin.
- Fix merged into mainline; pwn.ai publishes the technical write-up and Vercel publishes its challenge findings.
- The Hacker News reports CVE-2026-99999 (CVSS 9.3); stable fixes available in 5.10.272 through 7.2.11. No in-the-wild exploitation and no CISA KEV listing.
Sources cited for PwnEscape (CVE-2026-99999)
Detection coverage for TL-2026-3666
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3666 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.