sqzer-x/cve-2026-99999-scannerChecks whether a Linux system is affected by CVE-2026-99999 (PwnEscape) and prints or applies the distribution-specific kernel fix
English | 한국어
A single shell script that checks whether a Linux system is affected by CVE-2026-99999 ("PwnEscape"). It explains the verdict, then either prints the patch steps for that distribution or patches and reboots the system for you.
The vendor data embedded in the script is current as of 2026-10-20. Advisories change quickly, so always confirm with your distribution's security tracker.
| Component | Linux kernel IPv4 stack (skb_checksum_help → ip_do_fragment) |
| Cause | checksum_start / csum_offset supplied through the virtio-net header or packet sockets is not validated against the IPv4 header. Completing the checksum can then overwrite the already-validated header length (CWE-20). |
| Impact | Guest VM → host: host memory disclosure, host crash, code execution as root on the host |
| Severity | CVSS 3.1 9.3 Critical (kernel CNA) · 8.8 Important (Red Hat) |
| Affected | Every kernel since 2.6.27 |
| Fix | Upstream commit 6785011f8b16 "ipv4: validate checksum_start before completing checksum" |
| Workaround | None published. The only fix is to boot a fixed kernel. |
The main risk is to virtualization hosts that run untrusted guests (KVM/QEMU, Firecracker, Proxmox, cloud and VPS hosts). Patching a guest's kernel does not protect the host.
| File | Description |
|---|---|
scanner-cve-2026-99999.sh | The scanner, English output |
scanner-cve-2026-99999_kr.sh | The same scanner, Korean output |
Both files contain the same logic; only the messages and comments differ.
| File | SHA-256 | MD5 |
|---|---|---|
scanner-cve-2026-99999.sh | 65c3c226487d5bd80d436c06cc5256304cfa17011be82d8404c54355998801a6 | 8ab38c22ed737986775f6f64f5a800aa |
scanner-cve-2026-99999_kr.sh | 05d4af248ab2cab26566c81067ed35dd0a8c966f7fa8459867597c56ac43a805 | 6223f8db3c1a8dec361fe301a7193ff4 |
Verify the file before running it:
echo "65c3c226487d5bd80d436c06cc5256304cfa17011be82d8404c54355998801a6 scanner-cve-2026-99999.sh" | sha256sum -c
echo "8ab38c22ed737986775f6f64f5a800aa scanner-cve-2026-99999.sh" | md5sum -c
These values are for the files in the v1.0.0 release. Files on later commits may differ.
From the release (recommended):
curl -LO https://github.com/sqzer-x/cve-2026-99999-scanner/releases/download/v1.0.0/scanner-cve-2026-99999.sh
echo "65c3c226487d5bd80d436c06cc5256304cfa17011be82d8404c54355998801a6 scanner-cve-2026-99999.sh" | sha256sum -c
sudo bash scanner-cve-2026-99999.sh
Or from the repository:
git clone https://github.com/sqzer-x/cve-2026-99999-scanner.git
cd cve-2026-99999-scanner
sudo bash scanner-cve-2026-99999.sh
Run it on the host, not inside a container. Checking works as a regular user; root (through sudo) is only needed for menu option 1.
Detects the distribution (/etc/os-release) and the running kernel (/proc).
Judges the kernel:
Checks for an applied livepatch (kpatch, Canonical Livepatch, SUSE kernel-livepatch, Ksplice), a fixed kernel that is installed but not booted yet, and whether the next boot kernel is fixed.
Reports exposure indicators: /dev/kvm, vhost_net, TUN/TAP devices, VM processes (QEMU, Firecracker, Proxmox kvm, ...), user namespace settings.
If the system is not safe, offers a menu:
1. Patch now (install the fixed kernel and reboot)
2. Patch manually later (show the commands)
3. Exit
When not run from a terminal (cron, pipes, output redirected to a file), no menu is shown and it behaves like option 2.
| Option | Description |
|---|---|
-l, --list | Print only the per-distribution status table |
--no-color | Disable colored output (NO_COLOR is honored too) |
--os-release FILE | Use this os-release file instead of /etc/os-release |
--uname-r STRING | Judge this kernel release instead of the running one (skips local checks) |
--uname-v STRING | Kernel build string (uname -v), needed for Debian kernels with --uname-r |
-h, --help | Show help |
| Code | Meaning |
|---|---|
| 0 | Safe (fixed, not affected, or livepatched) |
| 1 | Vulnerable — a fixed kernel is available |
| 2 | Fixed kernel installed — reboot needed |
| 3 | Vulnerable — no vendor fix yet, or end of life |
| 4 | Undetermined (unknown kernel, running inside a container, ...) |
The exit codes make it usable from configuration management or monitoring:
bash scanner-cve-2026-99999.sh --no-color > report.txt; echo "exit code: $?"
The verdict can be computed for values collected elsewhere, for example from a container or an inventory:
# On the target: uname -r ; uname -v ; cat /etc/os-release > os-release.txt
bash scanner-cve-2026-99999.sh --uname-r 5.14.0-570.12.1.el9_6.x86_64 --os-release os-release.txt
bash scanner-cve-2026-99999.sh --uname-r 6.1.0-38-amd64 \
--uname-v '#1 SMP PREEMPT_DYNAMIC Debian 6.1.176-1 (2026-08-02)' --os-release os-release.txt
bash scanner-cve-2026-99999.sh --list prints the same table.
| Distribution | Status | Fixed version |
|---|---|---|
| Upstream (kernel.org) | Fixed | 5.10.272 · 5.15.223 · 6.1.190 · 6.6.159 · 6.12.113 · 6.18.57 · 7.2.11 · 7.3-rc7. Other branches are end of life. |
| AlmaLinux 8 / 9 / 10 | Fixed (almalinux-testing repo, 2026-10-16) | kernel-4.18.0-553.174.2.el8_10 · kernel-5.14.0-687.57.2.el9_8 · kernel-6.12.0-211.66.2.el10_2 |
| AlmaLinux Kitten 10 | Next regular kernel update | — |
| RHEL 7 / 8 / 9 / 10 | Affected, no fix yet | — |
| Rocky Linux, CentOS Stream, other RHEL compatibles | No fix published | — |
| Oracle Linux UEK | Fixed | UEK R6 5.4.17-2136.360.3.1 (ELSA-2026-500397) · UEK R7 5.15.0-325.221.6.4 (ELSA-2026-500398) · UEK R8 6.12.0-207.111.5.4 (ELSA-2026-500399) |
| Oracle Linux RHCK | No advisory | — |
| Amazon Linux 2 | Fixed | 4.14 4.14.355-287.753 (ALAS2-2026-3962) · 5.4 5.4.302-229.498 (ALAS2KERNEL-5.4-2026-131) · 5.10 5.10.269-270.1108 (ALAS2KERNEL-5.10-2026-133) · 5.15 5.15.221-157.262 (ALAS2KERNEL-5.15-2026-117) |
| Amazon Linux 2023 | Fixed | kernel 6.1.188-233.385 (ALAS2023-2026-3197) · kernel6.12 6.12.110-135.201 (ALAS2023-2026-3196) · kernel6.18 6.18.54-121.166 (ALAS2023-2026-3192) |
| Debian | Fixed | bookworm 6.1.190-1 (DLA-4841-1) · trixie 6.12.113-1 (DSA-6568-1) · forky/sid 7.2.11-1. bullseye and older are not tracked. |
| Ubuntu 14.04 – 26.04 | Needs evaluation, no fix yet | — |
| SLES 12 SP5 / 15 SP4–SP7 / 16.x, SLE Micro, openSUSE Leap 16 | Affected, pending | — |
| openSUSE Leap 15.x, SLES 15 SP1–SP3 | End of life | — |
| Fedora, Arch, openSUSE Tumbleweed, Alpine, Gentoo | Follow upstream stable | see the upstream row |
AWS states that the EC2, Lambda and Fargate host infrastructure is not affected; Amazon Linux instances still need their own kernel updated.