PwnEscape vulnerability discovered in Linux kernel network stack

Security researchers have identified a critical vulnerability in the Linux kernel network stack, dubbed ‘PwnEscape’ (CVE-2026-99999). The flaw, which has a CVSS score of 9.3, allows a virtual machine guest to read host memory or potentially execute arbitrary code on the host system.

The vulnerability stems from how the kernel handles IPv4 checksum metadata. By sending network packets with incorrect checksum information, a guest can exploit a delay in checksum calculation to cause memory corruption. This can lead to the disclosure of sensitive host memory or a denial-of-service attack.

The flaw was discovered by researcher Paulos Yibelo of pwn.ai during a million-dollar bug bounty challenge hosted by Vercel. Yibelo utilized the AI model GPT-5.6 Sol to assist in source code analysis and investigating attack paths. While kernel patches have been released by providers such as Debian, Red Hat, and SUSE, experts note that current fixes are primarily defense-in-depth measures, with more comprehensive input validation still under development.