Two Linux VM escape vulnerabilities: PwnEscape and Vghost — beyond KVM

Two Linux kernel vulnerabilities have been disclosed that can breach VM isolation: CVE-2026-99999 (PwnEscape) and CVE-2026-74580 (Vghost). The first involves deferred network checksum calculation, while the second involves a stale address-translation cache in the vhost subsystem.

CVE-2026-99999 — PwnEscape: modifying the IPv4 header after validation

Researchers at pwn.ai discovered that guest-controlled CHECKSUM_PARTIAL metadata — skb->csum_start and skb->csum_offset — can cause skb_checksum_help() to write a checksum into an already-validated IPv4 header. In the demonstrated exploit chain, the kernel initially processes a packet with IHL=5 (20 bytes), but the deferred write changes it to IHL=15 (60 bytes). ip_do_fragment() then uses the modified header length and includes 32 bytes of host memory beyond the logical sk_buff data in outgoing fragments. The leak results from a mismatch between the packet's logical length and the size of the copied header.

In their own KVM test environment, the researchers turned the leak into a controlled 64-byte kernel-memory write and executed a command with root privileges on the host. The chain succeeded across four independent cold-boot tests, but the authors reserved the details of how they progressed from the leak to the write for a subsequent publication.

Commit 6785011f8b16, merged into the Linux mainline on October 14, 2026, adds ip_check_csum_start() before checksum completion in five IPv4 code paths. The fix prevents writes into an already-processed IPv4 header, but it does not constitute comprehensive validation of incoming virtio checksum metadata.

CVE-2026-74580 — Vghost: stale IOTLB cache and VM escape

The TencentOS Security Team discovered that Linux vhost does not invalidate the vq->meta_iotlb[] cache after virtqueue configuration changes through VHOST_SET_VRING_ADDR and VHOST_SET_VRING_NUM. As a result, the new configuration may reuse a stale IOTLB translation without revalidating the address range. The resulting pointer is passed to raw_copy_to_user() or raw_copy_from_user(), enabling memory read and write primitives.

The researchers demonstrated two attack scenarios: • Local privilege escalation. A user with access to /dev/vhost- leaks kernel addresses, determines the KASLR slide, overwrites modprobe_path, and executes code as root. The complete chain was reproduced on Ubuntu 26.04, RHEL 9.8, Amazon Linux 2023, Azure Linux 3.0, and Oracle Linux 10.2. On the latter four systems, /dev/vhost-vsock had 0666 permissions, making the attack accessible to an unprivileged local user. On the tested Ubuntu system, membership in the kvm group was required. • Guest-to-host escape. A guest VM with vIOMMU, iommu_platform, and VIRTIO_F_RING_RESET can reinitialize a virtqueue while retaining a stale cache entry. This causes an out-of-bounds write into the QEMU heap, outside the guest's memory region. The researchers demonstrated corruption of QOM structures and control over the QEMU process's instruction pointer (RIP), but did not claim to have completed an exploit chain that executes a root-level command on the host from the guest.

Commit de845981da67 invalidates the metadata cache when the virtqueue configuration changes. The first fixed releases of the corresponding stable kernel branches are 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2. For distribution kernels, backported fixes must also be considered.

Article (CVE-2026-99999): https://pwn.ai/blog/pwnescape

Article (CVE-2026-74580): https://www.openwall.com/lists/oss-security/2026/10/14/2

PoC (CVE-2026-74580): https://github.com/zhangutah/security-research/tree/main/pocs/linux/cve-2026-74580