While I’m still enjoying my vacation, this CVE is too interesting to pass by.

PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999).

First of all, it has a neat number, but it is also has 9.3 severity score.

This CVE describes how the IPv4 checksum check mechanism in Linux can be used to gain access to the host machine from a sandbox or a virtual machine.

The former article explains how this CVE was identified. And yes, it was found with help of AI, and apparently it dates back to the 2.x kernel versions. Modern kernels such as 6.x and 7.x are affected as well, although there are already security patches available.

Patch your stuff, especially if you’re providing resources for untrusted guests.

#security