Linux kernel flaw lets a guest VM read and crash its host

Linux kernel flaw lets a guest VM read and crash its host

15 October 2026: The Linux kernel maintainers have published CVE-2026-99999, a flaw in the IPv4 networking code that lets a workload inside a virtual machine read its host's memory, crash the host and, in the researcher's lab, run commands on it as administrator. The kernel's own record scores it 9.3, critical. Researcher Paulos Yibelo of pwn.ai named it PwnEscape and found it during Vercel's sandbox challenge, where the memory leak was shown against Vercel's production sandboxes.

Where the flaw sits

The bug is in how the host kernel completes packet checksums. A guest can hand over a frame with crafted checksum metadata; the host forwards it through its TAP device into the IPv4 stack, where the fragmentation code calls skb_checksum_help and corrupts the IPv4 header it has already validated. The record describes three outcomes, each reproduced with crafted packets: a continuous leak of host memory into packets the guest sends out, a host crash from two packets that takes down every sandbox on the machine, and command execution with full administrator rights.

The CVSS vector is local. An attacker has to be running code inside a guest already, which on a shared cloud or sandbox platform is exactly what a tenant does. The record says the guest needs no host credentials; it only sends traffic through its own virtual network card. Nobody has reported use in a real attack, and the flaw is not in CISA's catalogue of exploited bugs.

Which kernels carry the fix

The fix is commit 6785011f8b16 in the mainline kernel, merged for 7.3-rc7. The record lists these as the first fixed releases of each stable line:

• 5.10.272
• 5.15.223
• 6.1.190
• 6.6.159
• 6.12.113
• 6.18.57
• 7.2.11

Kernels before 2.6.27 predate the bug. The commit message calls the change "a defence in depth measure" and says a fuller check on packets entering the stack still needs work, so a follow-up patch is likely.

Who should patch first

The exposure falls on hosts that run untrusted guests: virtual machine and microVM platforms, CI runners, code sandboxes and hosting providers. It is the host kernel that needs the update; patching a guest changes nothing. Distributions backport fixes into their own kernel builds, so the version string alone does not prove a host is fixed; the distribution's advisory and a reboot into the new kernel do.

Vercel says it paid $242,000 across 1,285 reports in the two-week challenge and that this was the one critical finding; no report showed access to customer data. Besides patching, it keeps nested virtualisation off and runs each Firecracker microVM under the jailer with restricted permissions, which limits what a breakout could reach. Our vulnerability management software category lists 16 products and our virtualization software category 14.

Related on TrustList:

• XSA-523: two grant copy flaws let a Xen guest read and write Dom0 memory
• AWS fixes EKS network policy bypass and a Firecracker memory flaw
• LXD and MicroCloud fix a flaw that lets a public certificate log in

Sources

• CVE-2026-99999 record, assigned by the Linux kernel CNA (ipv4: validate checksum_start before completing checksum), 15 October 2026
• Vercel: Findings from the $1M Vercel Sandbox challenge, 14 October 2026
• The Hacker News: Critical PwnEscape Linux kernel vulnerability lets guest VMs read host memory, 16 October 2026