# PwnEscape (CVE-2026-99999): Linux Kernel IPv4 Checksum-Offload Flaw Lets Guest VMs Read Host Memory

> A flaw in the Linux kernel's IPv4 checksum-completion code lets guest-controlled CHECKSUM_PARTIAL metadata rewrite IPv4 header bytes after validation, leaking about 32 bytes of host kernel memory per packet. Paulos Yibelo (pwn.ai) demonstrated the leak against Vercel's production sandboxes during Vercel's $1M Sandbox challenge, and showed host crash and host-root code execution only on researcher-owned lab hosts. No in-the-wild exploitation has been reported and the CVE is not in CISA KEV.

- **Published:** 2026-10-15T20:54:48Z
- **Last reviewed:** 2026-10-15T20:54:48Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3666
- **ID:** TL-2026-3666
- **Severity:** CRITICAL (CVSS 9.3)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-99999

## Description

CVE-2026-99999 (dubbed PwnEscape) is a deferred-metadata trust inversion in the Linux kernel host networking stack. Untrusted skb->csum_start and skb->csum_offset values supplied by a guest were not validated against the current network-header context before skb_checksum_help() performed its deferred checksum write. The write could therefore land inside an IPv4 header that the kernel had already parsed and made decisions on. The issue is in the host Linux networking stack, not in the hypervisor itself. NVD records the affected range as Linux 2.6.27 and later, touching IPv4 output, netfilter, xfrm and bridge code, with CVSS 3.1 vector AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (9.3).

The primary entry vector is virtio-net on KVM hosts (__virtio_net_hdr_to_skb()). TUN devices and AF_PACKET sockets are secondary attack surfaces in non-hypervisor contexts. In the lab-demonstrated information-disclosure stage, an attacker inside the guest crafts a fragmented IPv4 packet with CHECKSUM_PARTIAL metadata and sets csum_start so it overlaps link-layer boundaries. The checksum write overwrites the IPv4 ihl field from 0x45 (20-byte header) to 0x4f (60-byte header). ip_do_fragment() then consumes the altered ihl, treats the header as 60 bytes, and copies about 32 bytes beyond the packet's logical linear data into the transmitted fragments, where host kernel memory appears as IPv4 options. Besides skb_checksum_help() and ip_do_fragment(), four more IPv4 checksum-completion consumers are affected.

The researcher reported demonstrating controlled 64-byte host-kernel writes using allocation-sensitive techniques and object-lifetime manipulation on researcher-owned KVM instances. He also reported host-root helper execution on researcher-owned Linux 6.12 and 7.x kernels across four true cold boots. Vercel's report states that the memory leak was shown against production systems, while the crash and code-execution proofs ran on matching test configurations. Vercel Sandbox uses a Firecracker microVM with a dedicated guest kernel per sandbox. Vercel stated that no report showed anyone accessing customer data.

The upstream fix is commit 6785011f8b16 by Michael S. Tsirkin (Red Hat). It adds an ip_check_csum_start() guard across five checksum-completion paths, enforcing csum_start >= network_header + ip_hdrlen(skb), and is described as a defence-in-depth measure. First fixed stable releases are 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 and 7.2.11, with 7.3-rc7 and later also fixed per NVD. The discovery used the researcher's AI-assisted Omega-Pwn harness (SingularityNET OmegaClaw architecture with GPT-5.6 Sol as primary reasoning engine), per The Hacker News. The attack requires code execution inside the guest, so the realistic risk is to multi-tenant sandbox, cloud and virtualization providers running unpatched host kernels.

## MITRE ATT&CK

- T1611 Escape to Host
- T1005 Data from Local System
- T1059 Command and Scripting Interpreter
- T1588.005 Obtain Capabilities: Exploits

## Sources

- [Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory](https://thehackernews.com/2026/10/critical-pwnescape-linux-kernel.html)
- [PwnEscape (CVE-2026-99999) technical write-up - pwn.ai](https://pwn.ai/blog/pwnescape)
- [Findings from the $1 Million Vercel Sandbox Challenge](https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge)
- [NVD - CVE-2026-99999](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-99999)
- [CISA Known Exploited Vulnerabilities catalog (CVE not listed per The Hacker News)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3666