CVE-2026-99999

Status: ReceivedCritical (9.3)—PoC

Severity9.3Critical · CVSS 3.1

Exploitation probability0.21 %higher than 11% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitAvailableProof of concept on GitHub (unverified)

News and reports on Orbitaley

In the Linux kernel, the following vulnerability has been resolved:

ipv4: validate checksum_start before completing checksum

If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief.

This was discovered and reported by Paulos, and has been reporoduced by others independently since.

We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum.

A more complete validation at input is forthcoming, but needs more work.

CVSS

Base score: 9.3
Version: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.21 %
Percentile among all scored CVEs: 11
Score date: 10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Proof of concept on GitHub (unverified) · List of proofs of concept on GitHub

⚠️ GitHub proofs of concept are not verified: some are fake or contain malware. Never run them outside an isolated lab.

Media coverage

Specialised security media that have cited this CVE:

Borns IT- und Windows-Blog · Linux: KVM-Schwachstelle PwnEscape (CVE-2026-99999) erlaubt Ausbruch (10/19/2026)
El Hacker · Vulnerabilidad crítica en Linux KVM permite escape de invitado a anfitrión (10/19/2026)
The Register · Linux KVM guest-host escape rated critical, may represent a new way to attack penguin-powered networking (10/19/2026)
El Hacker · Fallo crítico de Linux permite escapar de máquinas virtuales y controlar hosts (10/16/2026)
The Hacker News · Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory (10/15/2026)

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1068 Exploitation for Privilege Escalationprivilege escalation60 %
Primary impactT1565 Data Manipulationimpact30 %

El vector AV:L/PR:N/UI:N indica explotación local sin interacción (T1068); el texto solo dice que skb_checksum_help puede corromper la cabecera de red, sin detallar escalada ni ejecución.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Threat Intelligence Program Restrict File and Directory Permissions Remote Data Storage Network Segmentation Execution Prevention Encrypt Sensitive Information

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Linux — Linux Kernel^AI

CWEs

CWE-20

References

Show 11 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-99999",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-99999",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-16T15:49:03.519458Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.3,
          "attackVector": "LOCAL",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.5
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "lessThan": "a464d950f31c89565cbaae038cc60db04fe01956",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "lessThan": "0fab003ef4698e0628060a45a48f14b43ba2a40a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "lessThan": "94524b7b32691de2e2ce162c04d6cbc9106e5cbf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "lessThan": "a65f69e0f38ffbed1b128029e09097436416dc8b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "lessThan": "32a8b0adaa18e52aaa0b246b5ffe683075354dbb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "lessThan": "f3e835af6226f1dd12160cbd696081e9b6155de0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "lessThan": "c3e33464746166264334641dc850a36eef7e6326",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "lessThan": "6785011f8b16abf40b1e9d8b2e332232b3e68822",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "include/net/ip.h",
            "net/bridge/netfilter/nf_conntrack_bridge.c",
            "net/ipv4/ip_output.c",
            "net/netfilter/nfnetlink_queue.c",
            "net/netfilter/xt_CHECKSUM.c",
            "net/xfrm/xfrm_output.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.27"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.27",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.272",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.223",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.190",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.159",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "include/net/ip.h",
            "net/bridge/netfilter/nf_conntrack_bridge.c",
            "net/ipv4/ip_output.c",
            "net/netfilter/nfnetlink_queue.c",
            "net/netfilter/xt_CHECKSUM.c",
            "net/xfrm/xfrm_output.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-15T13:17:14.137",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a65f69e0f38ffbed1b128029e09097436416dc8b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c3e33464746166264334641dc850a36eef7e6326",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f3e835af6226f1dd12160cbd696081e9b6155de0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://pwn.ai/blog/pwnescape",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/10/15/5",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: validate checksum_start before completing checksum\n\nIf a packet with bad checksum metadata gets into the ipv4 stack,\nskb_checksum_help can corrupt the network header and cause a bunch of\nmischief.\n\nThis was discovered and reported by Paulos, and has been reporoduced\nby others independently since.\n\nWe really shouldn't allow such packets in, but as a defence\nin depth measure, let's also check before we complete the checksum.\n\nA more complete validation at input is forthcoming, but needs more work."
    }
  ],
  "lastModified": "2026-10-19T22:17:28.667",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}