CVE-2026-99999
ipv4: validate checksum_start before completing checksum
- Published
- Oct 15, 2026
- Updated
- Oct 24, 2026
- Assigning CNA
- Linux
- Evidence observed
- Nov 4, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HLow · next 30 days
- Percentile
- 56.3%
- Model date
- Nov 4, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.
Sources
CVE-2026-99999 Working PoC — real VM escape for Linux kernel csum_start bug (CVSS 9.3). Guest-to-Host heap leak. See also: CVE-2026-99999-analysis (Educational).
- CVE-2026-99999Detection
Spanish guide and Bash script to check whether a Linux host is exposed to CVE-2026-99999 (PwnEscape) VM-to-host kernel escape, with patch verification and mitigation steps.
Reproduction and analysis of the Linux IPv4 csum_start validation bug (CVE-2026-99999): header rewrite, 32-byte heap disclosure, leak oracle and KASLR defeat.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.