PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999)
Summary
Security researchers reveal PwnEscape CVE-2026-99999: a Linux kernel networking vulnerability enabling guest-to-host KVM escape via deferred checksum metadata. The report details how an asynchronous write can mutate the IPv4 header after parsing, leads to potential host memory disclosure and a bounded escape, and discusses the upstream patch that fixes the issue with a guard in checksum completion. The piece also emphasizes defense-in-depth and the broader implications for sandboxed environments.