{"id":12152,"date":"2026-10-19T16:12:23","date_gmt":"2026-10-19T22:12:23","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-115-pwnescape-allows-attacking-the-host-from-a-virtual-machine\/"},"modified":"2026-10-19T16:28:52","modified_gmt":"2026-10-19T22:28:52","slug":"alert-2026-115-pwnescape-allows-attacking-the-host-from-a-virtual-machine","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-115-pwnescape-allows-attacking-the-host-from-a-virtual-machine\/","title":{"rendered":"Alert 2026-115 PwnEscape allows attacking the host from a virtual machine"},"content":{"rendered":"\n

Affected product(s):<\/h2>\n\n

CVE-2026-99999 affects code present in the Linux kernel since version 2.6.27, when the corresponding fix has not been incorporated. The main scenario investigated is a Linux virtualization host that processes IPv4 traffic and controlled checksum metadata from a guest virtual machine.<\/p>\n\n

Kernel branch<\/strong><\/td>Affected versions within the branch, without the patch<\/strong><\/td>First corrected version<\/strong><\/td><\/tr>
5.10<\/strong><\/td>Up to 5.10.271<\/td>5.10.272<\/td><\/tr>
5.15<\/strong><\/td>Up to 5.15.222<\/td>5.15.223<\/td><\/tr>
6.1<\/strong><\/td>Up to 6.1.189<\/td>6.1.190<\/td><\/tr>
6.6<\/strong><\/td>Up to 6.6.158<\/td>6.6.159<\/td><\/tr>
6.12<\/strong><\/td>Up to 6.12.112<\/td>6.12.113<\/td><\/tr>
6.18<\/strong><\/td>Up to 6.18.56<\/td>6.18.57<\/td><\/tr>
7.2<\/strong><\/td>Up to 7.2.10<\/td>7.2.11<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Description<\/h2>\n\n

PwnEscape, identified as CVE-2026-99999 (CVSS 9.3), is a vulnerability in the IPv4 network stack of the Linux kernel that allows an attacker controlling a guest virtual machine to compromise the isolation from the host through packets with manipulated checksum metadata.<\/p>\n\n

The flaw is related to the validation of metadata used to complete the IPv4 packet checksum. A manipulated packet can cause a write that modifies the IPv4 header after the kernel has already processed and validated it. In the investigated scenario, this metadata comes from a virtual machine through virtio-net.<\/p>\n\n

Although the research focuses on a KVM virtual machine escape, the flaw resides in the Linux kernel and not exclusively in KVM. The exposure depends on the kernel version, the patches incorporated, and the host’s network and virtualization configuration.<\/p>\n\n

Affected products and platforms<\/strong><\/p>\n\n

Product or platform<\/td>Exposure condition<\/td><\/tr><\/thead>
Linux hosts with a vulnerable kernel<\/td>Systems that process packets with the manipulated metadata described in the research.<\/td><\/tr>
Linux hypervisors with KVM and virtio-net<\/td>Hosts running virtual machines from which an attacker can send manipulated traffic to the host’s network stack.<\/td><\/tr>
Multi-user virtualization platforms and VM-based sandboxes<\/td>Higher risk when hosting client virtual machines or untrusted workloads on shared infrastructure.<\/td><\/tr>
Distributions such as CloudLinux, AlmaLinux, Ubuntu, and Red Hat Enterprise Linux<\/td>Validate the impact and availability of the corrected package by version and kernel variant in each vendor’s advisory.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

The research reports kernel memory leakage and an exploitation chain that achieved code execution as root on lab hosts.<\/p>\n\n

The risk is especially relevant for hypervisors, multi-user platforms, and environments running untrusted virtual machines.<\/p>\n\n

Fixes exist in stable kernel branches; their availability must be verified with each distribution.<\/p>\n\n

Solution<\/h2>\n\n

The solution consists of installing the corrected kernel published by the vendor for the version and variant of the affected system. The fixes were incorporated into the stable branches indicated below; distributions may incorporate the patch into their own packages without using these same version numbers. Therefore, the manufacturer’s advisory should be the reference for validating remediation.<\/p>\n\n

Kernel branch<\/strong><\/td>Corrected stable version<\/strong><\/td><\/tr>
5.10<\/strong><\/td>5.10.272<\/td><\/tr>
5.15<\/strong><\/td>5.15.223<\/td><\/tr>
6.1<\/strong><\/td>6.1.190<\/td><\/tr>
6.6<\/strong><\/td>6.6.159<\/td><\/tr>
6.12<\/strong><\/td>6.12.113<\/td><\/tr>
6.18<\/strong><\/td>6.18.57<\/td><\/tr>
7.2<\/strong><\/td>7.2.11<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Additional information:<\/h2>\n\n