In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.
Fix
Microsoft's update · Critical
- Release Notes — azl3 kernel 6.6.157.1-1 on Azure Linux 3.0 · build 6.6.159.1-1
From the 2026-Oct release note of Microsoft's Security Update Guide, revised 2026-10-28.
Public exploits 14
- 01luyicheng/CVE-2026-99999 PoC on GitHub
- 01luyicheng/CVE-2026-99999-analysis PoC on GitHub
- 01luyicheng/CVE-2026-99999-exploit PoC on GitHub
- MChorfa/csumguard PoC on GitHub
- PeronGH/CVE-2026-99999 PoC on GitHub
- Quaerendir/cve-2026-99999-audit PoC on GitHub
- alvaroguzmancode/CVE-2026-99999 PoC on GitHub
- gandli/CVE-2026-99999-pwnescape PoC on GitHub
- kingahmadr/CVE-2026-99999-kernel-check PoC on GitHub
- nsrg-fmlorg/kpatch-alma-cve-2026-99999 PoC on GitHub
- nsrg-fmlorg/kpatch-rocky-cve-2026-99999 PoC on GitHub
- shizuku198411/CVE-2026-99999-KVM-checksum-metadata-non-destructive-PoC PoC on GitHub
- sqzer-x/cve-2026-99999-scanner PoC on GitHub
- unixreaper/CVE-2026-99999-Research PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Vendor advisories in the News 1
- Issue in the Linux kernel virtio-net/TAP networking path affecting KVM-based hypervisors AWS Security Bulletins · 2026-10-15
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
In the news 5
- Linux KVM guest-host escape rated critical, may represent a new way to attack penguin-powered networking The Register · Security · 2026-10-19
- Xen vs KVM Hypervisor Security After CVE-2026-99999 r/cybersecurity · 2026-10-16
- PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999) r/netsec · 2026-10-16
- Major security vulnerability in Linux has just been published — CycleOS is already patched r/cybersecurity · 2026-10-15
- Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory The Hacker News · 2026-10-15
Change history 5
- StatusReceived → PublishedNVD modified 2026-10-19 21:19
- CwesCWE-20NVD modified 2026-10-19 22:17
- References+1 -1 references (now 11)NVD modified 2026-10-19 10:19
- References+1 references (now 11)NVD modified 2026-10-15 23:19
- First seenCVSS 9.3NVD modified 2026-10-15 13:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 11
- https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a
- https://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbb
- https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822
- https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf
- https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956
- https://git.kernel.org/stable/c/a65f69e0f38ffbed1b128029e09097436416dc8b
- https://git.kernel.org/stable/c/c3e33464746166264334641dc850a36eef7e6326
- https://git.kernel.org/stable/c/f3e835af6226f1dd12160cbd696081e9b6155de0
- https://pwn.ai/blog/pwnescape
- https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge
- http://www.openwall.com/lists/oss-security/2026/10/15/5