CVE-2026-99999 (PwnEscape): The Linux Kernel Flaw From VM to Host, and How to Check Your Servers

Direct answer: CVE-2026-99999, which its researchers named PwnEscape, is a flaw in the IPv4 network stack of the Linux kernel. Packets from a guest VM can make the host kernel rewrite an IPv4 header that already passed its checks. The host then leaks 32 bytes of its memory per packet, and the researchers built that into a guest-to-host escape in their own lab.

The kernel.org CNA, the body that issues CVEs for the Linux kernel, gives a CVSS score of 9.3 (Critical). Ubuntu gives a priority of Medium. On 19 October 2026, no Ubuntu kernel package has the Fixed status yet.

Main condition: This flaw is most dangerous for a host that runs VMs or code from other parties: AI agentAI agentAn AI program that performs work steps by itself, for example reading a message, drafting a reply, and recording the result.Open the glossary sandboxes, CI runners, and virtualization servers. If you rent a VPS, the kernel that needs the patch is the provider's host kernel. Limit: This article holds no exploit code, and we did not test an exploit.

Package status can change after 19 October 2026, so repeat step 3 before you decide. We read the Ubuntu CVE page, the Ubuntu JSON API, NVD, the Debian security tracker, the Red Hat CVE page, the SUSE CVE page, the CISA KEV catalog, the Vercel Sandbox challenge findings, and the PwnEscape write-up by pwn.ai on 19 October 2026. We ran the commands in steps 1 to 3 on an Ubuntu 24.04 based laptop on the same date; the host name is masked and the simulation uses dummy data.

The problem: a 9.3 score, a Medium priority, and no package yet

Server admins see three signals that look contradictory. The Ubuntu page shows 9.3 Critical, and the Ubuntu priority label next to it says Medium. Today, apt upgrade changes nothing for this CVE.

Mixed signals lead to two mistakes. The first team panics and installs a kernel from an unofficial source on a production server. The second team reads Medium and waits, while their host runs AI agent code from outside repositories.

The risk sits in the machine role, not in the flaw name. A host that runs other people's VMs is not the same as the VPS you rent, and neither is the same as a work laptop. Guides on installing an agent on an Ubuntu server cover the layer inside the server; this article adds the layer below it, the host kernel.

The context is also new. Vercel opened a US$1 million challenge to break Vercel Sandbox in August 2026, then received 1,285 reports in 2 weeks and paid US$242,000. The only Critical finding was this kernel flaw, and Vercel wrote that researchers now hunt "at AI speed".

How it works: the header is checked, then rewritten

Checksum metadata is a promise to write later

The Linux kernel does not always compute a TCP or UDP checksum when it builds a packet. A packet can carry the CHECKSUM_PARTIAL state and two numbers: csum_start (where the sum starts) and csum_offset (the distance to the result field). The function skb_checksum_help() later writes the result at csum_start + csum_offset, as the kernel Checksum Offloads documentation describes.

On a VM, this metadata can come from the guest through the virtio-net header. The PwnEscape write-up by pwn.ai stresses one point: those numbers are not only a description. They authorize a write into packet memory.

The wrong order in ip_do_fragment

The host receives a packet with a normal IPv4 header. Its first byte is 0x45: version 4, IHL 5, which means a 20-byte header. Routing and fragmentation make their decisions on that 20-byte header.

Before the fix, ip_do_fragment() completed the checksum first and read the IPv4 header after that. With crafted metadata, the checksum write lands inside the header itself. In the researchers' test, the first byte changed from 0x45 to 0x4f, which means IHL 15, or a 60-byte header.

From a 32-byte leak to an escape

The linear packet data holds only 28 bytes: a 20-byte header and 8 bytes of data. The fragmenter copies 60 bytes as the header, so 32 bytes of host memory outside the packet go out as IP options.

The Vercel Sandbox challenge findings state that this memory leak was demonstrated against Vercel production sandboxes. The host crash and the code execution were demonstrated on the researcher's own KVM and Firecracker machines with the same configuration. Vercel also states that no report showed access to customer data.

The PwnEscape write-up by pwn.ai describes 64-byte writes into host kernel memory, then a root command on the researcher's own test host, across 4 cold boots. The researchers expect exploits for weaker configurations within weeks. That is a researcher claim, not a recorded event.

The upstream fix and its limit

The patch by Michael S. Tsirkin adds the helper ip_check_csum_start() in include/net/ip.h. It has one rule: csum_start must sit after the end of the IPv4 header, and the kernel checks it before it writes the checksum. The check runs at 5 call sites in 6 files.

Commit 6785011f8b16 entered net.git on 8 October 2026 and mainline on 14 October 2026. The commit message calls it defence in depth, and fuller input validation is still in progress in the patch discussion on netdev. So a patched kernel closes the proven path, but it does not redesign the whole virtio checksum APIAPIThe official door 2 systems use to exchange data, without anybody copying it by hand.Open the glossary.

The NVD record states that the flaw exists since Linux 2.6.27. The table below lists the upstream stable versions that carry the fix.

This table is for upstream kernels. Distro kernels use their own version numbers and ship backports, so do not compare an Ubuntu kernel number directly with this table. Steps 2 and 3 show how to check.

Ratings: why Ubuntu says Medium for a 9.3 score

Four parties give four labels. Each label answers a different question, so you cannot compare the numbers directly.

The Ubuntu About CVEs page states that the Ubuntu priority is distinct from a CVSS score. The same page states that CVSS is not a measure of risk. The Ubuntu CVE page holds no notes or mitigation for this CVE on 19 October 2026.

Our inference: the flaw needs a local position, such as code inside a guest, so a normal laptop or server without third-party VMs is outside its main path. That is why Medium is reasonable for the average Ubuntu user. For a sandbox host, the label does not change your order.

Keep one note in mind. The Red Hat CVE page states that Red Hat tracks this flaw as a KEV active-exploit case, but the CISA KEV catalog version 2026.10.16 does not list CVE-2026-99999. Treat the exploitation status as uncertain, and check that catalog again.

Timeline: 3 days to the primitive, 7 weeks to the patch

Vercel opened the challenge on 18 August 2026. The researcher sent the memory-leak report on 20 August, then reported to the kernel security team with patches on 4 September. The final patch reached mainline on 14 October, and the CVE was published on 15 October on CVE.org.

The PwnEscape write-up states that the research used GPT-5.6 Sol as the reasoning engine, with humans in the lead, for less than US$700 of API tokens. The oss-security post of 15 October 2026 holds a copy of that write-up. The lesson for a small team: the gap from flaw to exploit gets shorter, so your patch path must be ready before the next headline.

What you need before you start

• Shell access to each Linux machine, with sudo rights for step 5.
• curl and jq. On Ubuntu, install jq with sudo apt install jq if it is missing.
• A machine list: virtualization hosts, container servers, rented VPS, and work laptops.
• The support contact of each VPS provider and access to its ticket panel.
• A reboot window that the service owner approves. A new kernel runs only after a reboot.

Step 1: Identify the role of each machine

Open a terminal on each machine, then run these three commands. All three only read and do not change the system.

systemd-detect-virt
ls -l /dev/kvm
lsmod | grep -E '^(kvm|kvm_amd|kvm_intel|vhost_net|tun) '

If systemd-detect-virt prints a hypervisor name, such as kvm or microsoft, you are inside a guest. If /dev/kvm exists and the machine runs VMs or sandboxes for other parties, the machine is a host with order 1 in step 4.

In our test on 19 October 2026, the laptop printed none and the kvm_amd module was loaded. The machine can act as a KVM host, but it ran no third-party VM during the test. This step is done when each machine on the list has one role: host, container server, rented VPS, or laptop.

Step 2: Record the running kernel and its source package

Run the three commands below on the same machine. The third command finds the source package of the running kernel image.

uname -r
cat /proc/version_signature
dpkg-query -W -f='${source:Package} ${Version}\n' linux-image-$(uname -r)

In our test, the upstream base was 7.0.14, and the 7.0 branch is not in the table of fixed stable versions. That does not mean this Ubuntu kernel will stay unfixed. Ubuntu ships backports in its own packages, so the official status is in step 3.

If the source package name starts with linux-signed, remove the -signed part to get the name in the Ubuntu tracker. Example: linux-signed-hwe-7.0 becomes linux-hwe-7.0. This step is done when each machine has three values: uname -r, the upstream base, and the source package name.

Step 3: Read the CVE status for your release and package

The Ubuntu CVE page shows a status table per package and per release. For many machines, the Ubuntu JSON API is faster. Replace the pkg value with the package name from step 2, and the rel value with your release codename: noble for 24.04, jammy for 22.04, focal for 20.04, and resolute for 26.04.

curl -s https://ubuntu.com/security/cves/CVE-2026-99999.json \
  | jq -r --arg pkg linux-hwe-7.0 --arg rel noble '
    "priority: \(.priority)  cvss3: \(.cvss3)",
    (.packages[] | select(.name == $pkg) | .statuses[]
     | select(.release_codename == $rel) | "\($pkg) \($rel): \(.status)")'

On 19 October 2026, every kernel package in the Ubuntu releases we checked had the needed status in the API. The released status appeared only on the upstream row, not on an Ubuntu release.

When the status changes to released, the description field in the JSON holds the package version with the fix, and the web page shows it as Fixed. Keep that version for step 5. This step is done when each machine has a dated status: needed, or released with a version.

Step 4: Set the action order from the machine role

Combine the role from step 1 with the status from step 3. The diagram below gives the order we use for clients.

Order 1 is a host that runs other people's VMs or AI agent code, because that is the PwnEscape path. Rama Digital recommendation: while the status is needed, run untrusted work on a host whose kernel is already Fixed, or pause that work. Examples of untrusted work: code that an AI agent writes, CI jobs from outside pull requests, and customer VMs.

If your agent runs without a sandbox, its code already runs directly on the host. Read where an MCP server should run before you place an agent server, and read access rights, approval, and audit logs for an MCP server for the limits of agent tools.

Order 2 is a server that gives untrusted code access to TUN or AF_PACKET. The PwnEscape write-up states that the upstream review also discussed TUN and AF_PACKET cases without a VM, but we found no public proof that anyone uses that path. Check the --privileged and --cap-add options on your containers, then remove CAP_NET_ADMIN and CAP_NET_RAW where they are not needed.

Order 3 is a rented VPS, and the action sits with the provider. Send a written question: "Does the host kernel for my VPS include the CVE-2026-99999 fix, commit 6785011f8b16 or its backport? When is the install scheduled?" The guide on how to choose a VPS for an agent covers the provider traits that let you get an answer to a question like this.

Order 4 is a laptop or work PC with no third-party VMs. An attacker must already run code on that machine, so install the kernel update through the normal path when the status changes. This step is done when each machine has an order number and an action owner.

Step 5: Install the Fixed kernel, reboot, then prove it

When your release shows released, install the update from the official repository. The Ubuntu About CVEs page recommends sudo apt update && sudo apt upgrade and recommends that you do not pick packages one by one.

sudo apt update && sudo apt upgrade
ls /var/run/reboot-required
sudo reboot
cat /proc/version_signature

A new kernel runs only after a reboot. Before the reboot, /proc/version_signature still shows the old version. Reboot the order 1 hosts first, then follow the order from step 4.

Before the Fixed status appears, apt upgrade carries no fix for this CVE. Do not install a self-built kernel or a kernel from an unofficial source on production only because of this news. This step is done when /proc/version_signature holds the Fixed version, the reboot-required file is absent, and the API shows released for your release.

Simulation: 1 sandbox host, 2 VPS, 5 laptops

This example is a simulation with dummy data. A sample company runs an AI agent that writes and runs code on 1 Ubuntu 24.04 KVM host. The company also rents 2 VPS and uses 5 laptops.

Day X is the day Ubuntu ships the package. On 19 October 2026, that date is not known.

Checklist for your team

• Mark the role of each machine. Owner: server admin. Evidence: an inventory table with the systemd-detect-virt and /dev/kvm results.
• Record uname -r, the upstream base, and the kernel source package. Owner: server admin. Evidence: dated output of step 2.
• Read the CVE status for that release and package. Owner: server admin. Evidence: dated JSON output of step 3.
• Move or pause untrusted work on order 1 hosts. Owner: product owner. Evidence: a list of moved or paused jobs.
• Send a written question to each VPS provider. Owner: provider account holder. Evidence: ticket number and provider answer.
• Install the Fixed package, reboot, then check /proc/version_signature. Owner: server admin. Evidence: output after the reboot.
• Stop when all order 1 and 2 hosts hold the Fixed version and all providers have answered. Evidence: an inventory table with no needed rows.

Distro status on 19 October 2026

Rama Digital recommendation: if your order 1 host runs Ubuntu and the status is still needed, move untrusted work to a host whose kernel is already Fixed, or pause that work. On 19 October 2026, Debian 12 and 13 already have fixed packages. Choose the host move only if your team already runs that kind of host; if not, pause the work and wait for the Ubuntu package, because a rushed migration opens new risks.

Frequently asked questions

What is CVE-2026-99999, or PwnEscape? A flaw in the IPv4 network stack of the Linux kernel. Checksum metadata from a guest can make the host rewrite an IPv4 header after that header passed its checks. The host then leaks memory, and the researchers proved a guest-to-host escape in their lab.

Why does Ubuntu give Medium priority to a CVSS 9.3 flaw? The Ubuntu priority is the work order of the Ubuntu team, while CVSS rates the technical impact. Ubuntu wrote no specific reason for this CVE. Our inference: the flaw needs code inside a guest or on the local machine, so machines without third-party VMs are outside its main path.

Can my VPS be hacked through this flaw? The flaw attacks the host kernel, not the kernel inside your VPS. The risk is another tenant on the same host that reads host memory or takes over the host. Ask your provider about the host kernel status, and keep your VPS kernel updated.

Is there exploitation in the wild? On 16 October 2026, CISA SSVC recorded exploitation: none, and the KEV catalog version 2026.10.16 did not list this CVE. Red Hat states that it tracks the case as KEV active-exploit. The researchers expect exploits for weak configurations within weeks.

Which kernel versions carry the fix? For upstream kernels: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, 7.2.11, and 7.3-rc7. For a distro kernel, use the distro status, because its version numbers differ and the fix arrives as a backport.

Does apt upgrade close this flaw on Ubuntu today? Not on 19 October 2026. The Ubuntu kernel packages still show needed. Repeat step 3, then run apt upgrade and reboot when the status becomes released.

Next step

The limit still applies: the upstream fix is defence in depth, and fuller input validation is still in progress. If you run AI agents that execute code on your own server, AI Agent Ops Install installs the agent with hardening, access separation, and activity logs. On 19 October 2026, the service page lists a price from Rp 7.5 million to Rp 25 million and a duration of 1 to 2 weeks.

Book a 30-minute session if you want to map your hosts, VPS, and patch order in 1 session.

Sources

• Ubuntu CVE page and Ubuntu JSON API. Read 19 October 2026. Priority Medium, CVSS 9.3, status needed, empty notes and mitigation.
• Ubuntu About CVEs page. Read 19 October 2026. Priority and status definitions, and the apt upgrade advice.
• NVD and CVE.org. Read 19 October 2026. Published 15 October 2026, CVSS vector, fixed branches and versions, CISA SSVC of 16 October 2026.
• 6785011f8b16. The fix commit ipv4: validate checksum_start before completing checksum.
• PwnEscape write-up by pwn.ai and oss-security post of 15 October 2026. The 0x45 to 0x4f mechanism, the 32-byte leak, the timeline, and the limits of the researcher claims.
• patch discussion on netdev. The first patch discussion and input validation.
• Vercel Sandbox challenge findings. Published 14 October 2026. 1,285 reports, US$242,000, 1 Critical finding, and the production proof.
• kernel Checksum Offloads documentation. How CHECKSUM_PARTIAL, csum_start, and csum_offset work.
• Debian security tracker, Red Hat CVE page, and SUSE CVE page. Read 19 October 2026. Package status and rating of each distro.
• CISA KEV catalog. Version 2026.10.16, without CVE-2026-99999.