# Linux kernel gets a fix for a flaw that enabled attackers to escape VMs > Source: > Published: 2026-10-16 11:37:35+00:00 The Linux kernel’s networking stack was found vulnerable to a guest-to-host escape [attack](https://www.csoonline.com/article/4194085/16-year-old-kvm-flaw-allows-attackers-to-escape-vms-and-take-over-linux-servers.html), in which an attacker operating inside a virtual machine (VM) could cross the isolation boundary and access the underlying host. Dubbed PwnEscape and tracked as CVE-2026-99999, a flaw allowed guest-controlled packet metadata to trigger a write that changes an IPv4 header after the kernel has already processed it. That flaw could be chained with additional exploitation techniques to achieve host-level code execution. The problem was discovered by security researcher Paulos Yibelo of Pwn.ai while participating in Vercel’s $1 million Sandbox security challenge, announced on August 18. The challenge invited researchers to test the isolation boundaries of Vercel’s sandboxing infrastructure, including whether they could escape the virtual machine itself and reach the host. Vercel subsequently described PwnEscape as the most severe finding submitted through its program. “The packet-related crash and code execution attacks were demonstrated on the researcher’s own KVM and Firecracker machines matching Vercel Sandbox configuration,” Vercel’s principal security engineer Andy Riancho said in a [blog post](https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge). No reports showed anyone accessing customer data in Vercel Sandbox, he added. The issue is now resolved. An NVD [description](https://nvd.nist.gov/vuln/detail/cve-2026-99999) of the bug identified seven stable-branch fixes, including Linux versions [5.10](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a464d950f31c89565cbaae038cc60db04fe01956), [5.15](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0fab003ef4698e0628060a45a48f14b43ba2a40a), [6.1](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=94524b7b32691de2e2ce162c04d6cbc9106e5cbf), [6.6](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a65f69e0f38ffbed1b128029e09097436416dc8b), [6.12](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=32a8b0adaa18e52aaa0b246b5ffe683075354dbb), [6.18](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f3e835af6226f1dd12160cbd696081e9b6155de0), and [7.2](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c3e33464746166264334641dc850a36eef7e6326), and one mainline [fix](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6785011f8b16abf40b1e9d8b2e332232b3e68822). PwnEscape exploits Linux’s checksum-offloading mechanism, which allows the [kernel](https://www.csoonline.com/article/4169399/new-dirty-frag-exploit-targets-linux-kernel-for-root-access.html) to defer calculating a network packet’s checksum until a later stage of processing. The packet’s metadata specifies where the calculation should begin and where its result should be written. The problem arises when attacker-controlled checksum metadata directs that write into the packet’s IPv4 header. Linux initially processes the packet using its original header, but a later checksum-completion operation can change the header before fragmentation code consumes it again. Yibelo demonstrated this by successfully changing the IPv4 header’s interpreted length from 20 bytes to 60 bytes. The fragmented code then treated bytes beyond the packet’s valid data as part of the header, allowing 32 bytes of adjacent host memory to be included in an outgoing packet. This is effectively a time-of-check/time-of-use ([TOCTOU](https://www.csoonline.com/article/3962744/incomplete-patching-leaves-nvidia-docker-exposed-to-dos-attacks.html?utm=hybrid_search#:~:text=Time%2Dof%2DCheck%20Time%2Dof%2DUse)) problem: the kernel makes security-relevant decisions using one version of the header, then later acts on a modified version without revalidating it. However, the sequence does not require the usual race between threads; the deferred write occurs during normal networking operations, Yibelo said in a blog post. The accepted upstream fix, commit 6785011f8b16, introduces validation checks before the relevant checksum-completion operations. These checks prevent the checksum write from corrupting the IPv4 header along the affected processing paths. The patch was applied to the Linux development tree on October 8 and merged into the mainline kernel on October 14, according to the blog post. Yibelo described the change as a defence-in-depth measure, noting that broader validation of untrusted checksum metadata remains an area for further work. Yibelo reported chaining the memory leak with additional exploitation steps to achieve selected kernel-memory writes and execute a host-root helper on its own test systems. “We used the resulting capability in a bounded lab chain to execute a host-root helper and return a host-generated marker to the guest. Four separate true-cold boots completed that chain,” he said. While further details of how Yibelo achieved the guest-to-host escape are awaited, he stressed that the issue is not specific to KVM or another hypervisor, but lies in the Linux networking stack that handles guest traffic. “Although we suspect the security industry will use this post to figure out the other affected hypervisors and we expect exploits in weaker configurations to arrive in weeks, and exploits working in default hypervisor configurations to arrive in under a month,” Yibelo warned.