mz.
I was going through the Linux kernel CVE announcements this week when CVE-2026-99999 made me do a double take. A CVSS 9.3 networking bug that lets a guest VM reach into host kernel memory, discovered through Vercel’s $1M sandbox challenge. And the wild part? The vulnerability is not in KVM, Firecracker, or any hypervisor. It is in the Linux IPv4 stack itself, in how the kernel handles deferred checksum metadata.
Sources: SOC Prime analysis · pwn.ai research writeup · Linux kernel CVE announcement · NVD · Red Hat
Overview
Discovered by Paulos Yibelo of pwn.ai while poking at Vercel’s sandbox infrastructure, PwnEscape exploits improper validation of checksum metadata in IPv4 packet processing. A guest can feed a packet whose checksum bookkeeping tells the host kernel to rewrite the packet header after that header was already parsed and trusted. The result: a 32-byte host memory disclosure per crafted packet, and in a controlled lab, fully weaponized guest-to-host escape with root execution on the host.
| Field | Value |
|---|---|
| CVE | CVE-2026-99999 |
| Alias | PwnEscape |
| CVSS 3.1 | 9.3 (Critical) |
| Vector | AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| CWE | CWE-787: Out-of-bounds Write |
| Component | Linux kernel IPv4 networking (skb_checksum_help) |
| Introduced in | Kernel 2.6.27 |
| Fixed in | Commit 6785011f8b16, mainline 7.3-rc7 |
| Exploited in the wild | No public evidence, not in CISA KEV |
Technical Deep Dive
Linux does not always compute transport checksums right away. It can mark a packet CHECKSUM_PARTIAL and carry metadata saying where the checksum accumulation starts and where the result should land. That is normal checksum offload. The sk_buff bookkeeping looks like this:
skb->ip_summed CHECKSUM_PARTIAL (checksum still pending)
skb->csum_start location where checksum accumulation begins
skb->csum_offset offset from that location to the output field
write location = csum_start + csum_offsetThe problem is that these values are not just descriptive metadata. They authorize a write into packet memory that happens later, after the IPv4 header has already been parsed, validated, and trusted by fragmentation and routing code.
The order of operations is the bug. In the historical path, ip_do_fragment() completes the pending checksum via skb_checksum_help() before it reads the IPv4 header length. If guest controlled metadata placed that deferred write inside the header itself, the write mutates the very fields the kernel already made security decisions on.
/* Historical ordering, abbreviated for explanation */
if (skb->ip_summed == CHECKSUM_PARTIAL)
skb_checksum_help(skb); /* deferred write */
iph = ip_hdr(skb);
/* Fragmentation later derives hlen from iph->ihl. */Root Cause Analysis
The header field that gives the leak its shape is ihl, the 4-bit IPv4 header length counter. In the research case, the first word of the packet went from 0x4500 (IHL 5, 20-byte header) to 0x4f00 (IHL 15, 60-byte header) after the deferred write. Host ingress had validated and parsed a normal 20-byte header. Later fragmentation code read the mutated field and treated it as authoritative.
LESS-TRUSTED INPUT HOST NETWORK STACK
────────────────────── ─────────────────────────────────────
packet + partial-checksum metadata ─────► offload metadata installed in skb
│
▼
link-layer processing / L3 normalization
│
▼
IPv4 parse, reassembly, policy, routing
header trusted as IHL=5 (20 bytes)
│
▼
output fragmentation
│
▼
skb_checksum_help()
pending write can alter parsed header
│
▼
ip_do_fragment() consumes late IHL
header now claims 60 bytes
│
▼
header copy exceeds logical linear data
│
▼
emitted IPv4 options include host bytesWith 28 bytes of valid linear packet data (20-byte header + 8 bytes of first fragment) but a header copy claiming 60 bytes, the kernel copied 32 bytes beyond the packet’s logical data. Those bytes belong to the host, and the fragmenter happily ships them out as apparent IPv4 options. A bounded but repeatable host memory disclosure.
Beyond the leak: in a controlled KVM fixture with carefully managed allocations, the researchers turned the read into selected 64-byte host-kernel writes and then executed a host-root helper. The full chain reproduced across four cold boots of researcher-owned systems. Vercel reported no evidence customer data was exposed; the production demonstration confirmed the disclosure stage, not host root.
Discovery Timeline
| Date | Event |
|---|---|
| Aug 18, 2026 | Vercel launches the $1M Sandbox security challenge |
| Aug 20, 2026 | Initial bounded host-memory disclosure submitted |
| Sep 4, 2026 | Root cause reported to Linux kernel security contacts |
| Sep 7, 2026 | Michael S. Tsirkin (Red Hat) reproduces the issue |
| Oct 15, 2026 | Public announcement and CVE assignment |
Detection and Defence
There are no campaign IOCs to match because no real-world exploitation has been observed. Detection leans on host telemetry and correlation between guest networking activity and unexpected host behaviour.
| Layer | Detection Signal |
|---|---|
| Host | Unexpected kernel crashes tied to guest networking activity |
| Network | Anomalous IPv4 fragmentation behaviour from VM traffic |
| Virtualization | Unusual host-side effects after sandboxed workloads |
| Correlation | Guest network activity followed by host memory anomalies or panics |
Mitigation
The upstream fix, commit 6785011f8b16 “ipv4: validate checksum_start before completing checksum” by Michael S. Tsirkin, adds a guard that rejects a checksum start position inside an already parsed IPv4 header.
static inline int ip_check_csum_start(const struct sk_buff *skb)
{
if (unlikely(skb->csum_start <
skb->network_header + ip_hdrlen(skb)))
return -EINVAL;
return 0;
}
if (skb->ip_summed == CHECKSUM_PARTIAL) {
err = ip_check_csum_start(skb);
if (!err)
err = skb_checksum_help(skb);
if (err)
goto fail;
}The Linux kernel CVE team recommends upgrading to the latest supported stable kernel rather than cherry-picking the commit, and update the host kernel, not just the guests. Rebooting the host into the patched kernel and verifying the active version across every hypervisor matters.
| Kernel Branch | First Fixed Release |
|---|---|
| Linux 5.15 | 5.15.223 |
| Linux 6.1 | 6.1.190 |
| Linux 6.6 | 6.6.159 |
| Linux 6.12 | 6.12.113 |
| Linux 6.18 | 6.18.57 |
| Linux 7.2 | 7.2.11 |
| Mainline | 7.3-rc7 |
Bigger Picture
pwn.ai calls the pattern “deferred-metadata trust inversion”: untrusted metadata is validated against an early representation of a packet, then a metadata-driven operation runs later and changes security-relevant bytes that a downstream consumer trusts without rechecking. Checksum offload is just the first practical instance of it.
untrusted metadata enters
│
▼
validated against an early representation
│
▼
packet is normalized, parsed, authorized
│
▼
metadata-driven operation runs later
│
▼
security-relevant bytes change
│
▼
later consumer trusts the changed interpretation
│
▼
memory-safety or policy-boundary failureThe upstream developers describe the fix as defense in depth, with broader validation of malformed checksum metadata at ingress still pending. For anyone running untrusted workloads, cloud development sandboxes, build services, or AI agent execution environments, this is exactly the kind of bug to track: the affected surface is any host that exposes its networking stack to guest-controlled traffic.
If you run a hypervisor or sandbox host, check which kernel you are actually booted into, not just which package got installed. And keep an eye on kernel panic logs and host network traces for anything weird after guest traffic. This one is a reminder that the isolation boundary only holds if every layer behind the hypervisor holds too.