CVE-2026-99999

Name of the Vulnerable Software and Affected Versions Linux kernel versions 2.6.27 through 5.10.271 Linux kernel versions 5.15 through 5.15.222 Linux kernel versions 6.1 through 6.1.189 Linux kernel versions 6.6 through 6.6.158 Linux kernel versions 6.12 through 6.12.112 Linux kernel versions 6.18 through 6.18.56 Linux kernel versions 7.2 through 7.2.10 Linux kernel versions prior to 7.3-rc7

Description An out-of-bounds write issue exists in the Linux kernel networking stack due to a trust-inversion in how CHECKSUM PARTIAL metadata is handled. When processing IPv4 packets, the kernel may trust checksum metadata that allows the skb checksum help() function to modify an already-validated IPv4 header. This occurs because the metadata is not re-validated after L2 decapsulation, allowing a deferred write to mutate the Internet Header Length (IHL) field.

This flaw can be exploited by a guest virtual machine using virtio-net or TUN interfaces to cause host-memory disclosure, where approximately 32 bytes of host kernel memory are leaked per packet. In controlled laboratory environments, this has been used to achieve full KVM guest-to-host escape, allowing the execution of arbitrary code with root privileges on the host operating system. The issue primarily affects self-managed Linux hosts running untrusted guests or microVMs on x86 architectures.

Recommendations Update the host Linux kernel to the following versions or later: