The bug has a name: PwnEscape. CVE-2026-99999. Researcher Paulos Yibelo named it, and it is a better name than most CVE nicknames because that is what it does.
It is not a bug in KVM. That matters, because the first question most people ask when they hear “VM escape” is what the hypervisor got wrong. The answer here is: nothing in particular. KVM is fine. The bug is in the host kernel’s IPv4 networking stack, and it has been there since Linux 2.6.27.
what the bug actually is
Linux has a feature called checksum offload. Instead of computing a packet’s checksum
immediately, the kernel defers it: a packet carries metadata, csum_start and csum_offset,
that tell the kernel where to write the finished checksum when the time comes. That is a
performance optimization and it generally works.
The problem is that those metadata fields come from the packet, and a guest VM controls the
packet. csum_start and csum_offset do not merely describe the packet; they authorize a write
into packet memory. Linux was not validating them before acting on them.
With bad values, the checksum write overwrites part of the IPv4 header the kernel has already read and made decisions based on. In Yibelo’s working example, the header length field changed from 5 (a 20-byte header) to 15 (a 60-byte header). The host IP fragmentation code then treated that packet as having a 60-byte header, walking into memory it had no business touching.
From there, three things become possible: host kernel memory leaks back to the guest reliably for as long as packets keep flowing; the host crashes, taking every VM running on it with it; and with enough control over the writes, you chain a root shell on the host.
who is affected
Every Linux host running KVM with untrusted guests, back to 2.6.27. That is eighteen years of “the networking stack validates its inputs” being an assumption rather than a fact. Cloud VMs, co-lo boxes with someone else’s tenant running next to yours, any dev hypervisor with guest network access.
The patch adds validation before any checksum-completion operation can run. It has been backported to stable branches 5.10 through 7.2 and mainline (7.3 shipped yesterday). Both Red Hat and the kernel CVE team rate this Critical. Patch now.
the actually embarrassing part
The io_uring structural CVE from August involved a relatively new subsystem with known attack surface tradeoffs. That was at least a defensible “we’ll harden it” situation.
This is a checksum metadata validation bug in a path added in 2008. The networking stack runs it
on every packet. Nobody asked whether a guest could feed it bad csum_start values for eighteen
years.
Credit to Yibelo for publishing a full exploit chain with three separate impact tiers instead of sitting on it or selling it. That is how disclosure is supposed to work. The rest of this is on the kernel.
The kernel-security hub covers the broader hardening picture if this is not the first CVE to land on your desk this quarter.