Linux Kernel Networking Flaw Puts KVM Host Isolation at Risk

PwnEscape shows how a flaw in ordinary Linux networking code can undermine virtual machine isolation. Tracked as CVE-2026-99999, the vulnerability lets attackers send crafted traffic from a guest and potentially reach the host kernel, putting KVM-based environments at risk.

The bug was found by researchers at Pwn.ai during a $1 million challenge to hack Vercel’s sandbox, which runs KVM-based Firecracker microVMs. Rather than targeting KVM’s virtual machine or memory management, the exploit abuses Linux’s handling of network packets from guests.

The researchers demonstrated host-memory disclosure against Vercel’s production sandboxes. On systems they controlled, they also achieved host crashes and root-level code execution. Vercel confirmed the findings and said it had no reports of customer files, secrets, or application data being accessed.

A fix authored by Red Hat developer Michael S. Tsirkin has been merged into the mainline kernel, with patched kernels available for multiple distributions. The update must be installed on the host: patching guest virtual machines does not address the vulnerable code.

How checksum handling opens a path to host memory

The exploit centers on checksum offloading, which lets Linux defer a packet’s checksum calculation. The kernel carries metadata describing where to calculate the checksum and where to store the result. In virtual networking, that metadata can come from an untrusted guest.

The vulnerable code didn’t verify that completing the checksum would leave the already-validated IPv4 header unchanged. Guest-controlled metadata could therefore overwrite the header, changing the packet’s advertised length before Linux split it into smaller fragments for transmission.

In the researchers’ demonstration, the header length was changed from 20 bytes to 60, even though the packet buffer contained only 28 bytes of valid data. Fragmentation then copied 32 bytes beyond that data into outgoing packets, exposing host memory.

The team said repeated observations and control over memory allocations let them progress from disclosure to kernel memory writes, ultimately running a helper program as root. They haven’t published the full chain from memory leak to code execution, saying it warrants a separate technical write-up. The researchers also warned that exploits for weaker configurations could emerge within weeks, with attacks against default hypervisor configurations potentially following in under a month.

The vulnerable code sits outside KVM

PwnEscape’s location in the networking stack makes its reach harder to define than a flaw confined to one hypervisor component. For comparison, the Januscape vulnerability disclosed earlier this year affected KVM memory management. PwnEscape instead exploits the Linux host’s IPv4 networking subsystem.

The researchers say similar weaknesses may exist wherever guest-controlled metadata can change packet fields after validation. Tsirkin’s patch adds checks at five checksum completion points, including IPv4 fragmentation, bridge connection tracking, and packet filtering. The commit says a broader validation at packet input is still in development.

How far the flaw extends across virtualization and container systems remains unclear. Red Hat lists OpenShift Container Platform components as affected; Docker and Xen had not issued advisories in the source report.

Exploitation requires an attacker-controlled workload that can send malformed traffic through a virtual network. That makes the issue especially relevant to services that run untrusted code inside VMs. Alex Zenla, CTO and co-founder of container security firm Edera, told CSO that a guest escaping KVM can reach the host operating system’s processes, drivers, and network stack. “Security architecture has to assume that eventually, something will be compromised and make sure that compromise doesn’t become total host ownership,” he said.

AWS says its managed EC2, Lambda, and Fargate services aren’t affected. Customers who operate their own KVM virtual machines with virtio-net on vulnerable hosts should apply their distribution’s kernel update. Since vendors may backport the fix to older kernel versions, administrators should follow their distribution’s advisory rather than relying on version numbers alone.