PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999) pwn.ai

Researchers at pwn.ai say they found CVE-2026-99999, a Linux networking flaw in which guest-controlled checksum metadata could alter an already-validated IPv4 header, enabling a 32-byte host-memory disclosure and, in their own KVM lab, a guest-to-host escape. Linux merged upstream fix 6785011f8b16 in October 2026, adding checks before checksum completion in five IPv4 paths.