CVE-2026-99999 Is a KVM Guest-to-Host - Debian Has a Floor, Ubuntu and CloudLinux Still Don't

The Situation

NVD published CVE-2026-99999 on 15 October 2026 (lastModified 19 October 2026). Linux CNA CVSS 3.1 9.3 CRITICAL, vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Status on that fetch: Received. The description is the kernel commit message, not a marketing write-up: if a packet with bad checksum metadata reaches the IPv4 stack, skb_checksum_help can corrupt the network header. Introduced in Linux 2.6.27. Fixed in mainline as 6785011f8b16 - ipv4: validate checksum_start before completing checksum.[1][2]

The bug is not in KVM. pwn.ai (Paulos Yibelo): guest-controlled virtio checksum metadata rewrites an IPv4 header after the host kernel has already validated it. The vulnerable code is host net/ipv4. “KVM escape” is the trust boundary they crossed in a lab, not the source file.[3]

CISA KEV catalog 2026.10.20 (count 1754, dateReleased 2026-10-20T19:00:31Z) does not list CVE-2026-99999. Newest dateAdded rows that day are EG Secure Solutions, Plex, Siemens - not Linux/KVM. CISA SSVC on the NVD record: exploitation none, automatable no, technical impact total.[1][4]

What the vendors actually claimed

Keep these three rungs separate. They are not the same evidence.

1. Host-memory leak. pwn.ai: deferred checksum completion can change IPv4 ihl (they report 0x45 → 0x4f in the research geometry) so the fragmenter copies beyond logical skb_headlen. They measured 32 bytes of host memory in transmitted “options.” Vercel’s Sandbox-challenge write-up (published 14 October 2026): that leak was demonstrated against Vercel production sandboxes. That is Vercel’s sentence, not ours.[3][5]

2. Host crash. Vercel: two packets crashed a host, taking every sandbox on it down. Demonstrated on the researcher’s own KVM and Firecracker machines matching Vercel Sandbox configuration - not claimed as a production-Vercel crash.[5]

3. Host root. pwn.ai: on an owned KVM fixture, a later chain produced selected 64-byte host-kernel writes and a host-root helper that returned a marker to the guest (four cold boots). They say Part 2 will cover that chain; they do not claim production-provider root. Vercel likewise attributes crash and code execution to the researcher’s own machines. CloudLinux (post date 2026-10-16, modified 2026-10-19T08:11:56): no public PoC, they have not reproduced the attack. The leak, crash, and root “come from the researcher’s test host.”[3][5][6]

pwn.ai’s timeline: report 20 August; kernel security contact 4 September; net.git 8 October; mainline 14 October. oss-security pointer: Jan Schaumann, 15 October 2026.[3][7]

Who is actually exposed

CloudLinux, quoting kernel.org: the CVE record is the untrusted VM guest path. The VMM already forwards virtio-net offload headers. No host device node for the tenant. User namespaces do not close this. If you sell VPS / GPU guests on KVM, QEMU, or Firecracker, the guest is the customer.[6]

They also list other consumers of the same metadata, and they mark them plausible from the code, not confirmed in their tests:

unprivileged local user + tun IFF_VNET_HDR inside a user namespace
AF_PACKET + PACKET_VNET_HDR (CAP_NET_RAW, also available in a userns)
owner of a macvtap / ipvtap device

Shared hosting without VMs: only in play if a tenant can create an unprivileged user and network namespace. CloudLinux: user.max_user_namespaces is on by default on CloudLinux 8+. Their tests on 7h/8/8 LTS/9/9 LTS produced no oops and no KASAN on that local path. CageFS does not close the VM-guest path.[6]

Ubuntu’s tracker this morning still lists linux Vulnerable on 16.04 through 26.10, including 24.04 noble and 22.04 jammy. That is the tracker page, not a kernel we built.[8]

Debian’s tracker: bookworm 6.1.176-1 vulnerable, bookworm (security) 6.1.190-1 fixed; trixie 6.12.107-1 vulnerable, trixie (security) 6.12.113-1 fixed; forky/sid 7.2.11-1 fixed. Origins named there: DLA-4841-1 / DSA-6568-1. Notes point at the same mainline commit.[9]

NVD “unaffected” floors (kernel.org, semver): 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, 7.2.11, and 7.3 (the original commit for the fix). Anything older on those lines, treat as affected until the vendor package says otherwise.[1]

Hunt, then mitigate, then take the package

uname -r
# Debian/Proxmox: is the security repo actually enabled?
apt-cache policy linux-image-$(uname -r) 2>/dev/null | sed -n '1,12p'

# CloudLinux / KernelCare (vendor strings, Oct 16/19 post)
kcarectl --info | grep CVE-2026-99999 || true

# local path only - does not protect VM guests
sysctl user.max_user_namespaces
# as an unprivileged user: unshare -Urn ; echo $?

Debian bookworm / trixie hosts (including many Proxmox nodes that track Debian security):

apt update
apt-get -s upgrade | grep -E 'linux-image|proxmox-kernel' || true
# floor from Debian's tracker, not a Proxmox changelog we invented:
# bookworm linux 6.1.190-1 ; trixie linux 6.12.113-1

Do not assume proxmox-kernel-6.8 / 6.14 / 6.17 is fixed because Debian linux is. Check the Proxmox kernel changelog on that package. We did not find a Proxmox-specific advisory this morning.

CloudLinux (vendor status as of 19 October 2026 08:11 UTC - we did not re-query CLN):

No fixed CloudLinux kernel on streams 1-3 (7h/8, Alma-based 9/10, TuxCare ELS 8 LTS/9 LTS).
KernelCare: K20261016_0002 AlmaLinux 9 + CloudLinux 9 in the main feed; EL9 RHEL/Oracle/Rocky IDs still testing; el8 and el10 in progress.
Vendor verify: kcarectl --info | grep CVE-2026-99999. They also wrote that --patch-info | grep CVE-2026-99999 returns nothing even on a patched server - do not use that as a clean bill.[6]

kcarectl --update
kcarectl --info | grep CVE-2026-99999

Until the kernel or livepatch is on the host:

QEMU (CloudLinux’s command, untested by them against this bug):

-device virtio-net-pci,netdev=n0,csum=off,guest_csum=off

libvirt, inside the <interface> element:

<driver>
  <host csum='off'/>
  <guest csum='off'/>
</driver>

That is per VM and needs a guest restart. CloudLinux: it also drops guest TSO/GSO, so throughput falls. They call every workaround partial and untested. The kernel or KernelCare livepatch is the remedy.[6]

Local path only (does nothing for VPS guests):

sysctl -w user.max_user_namespaces=0
echo 'user.max_user_namespaces = 0' > /etc/sysctl.d/90-no-userns.conf

That breaks rootless containers, Chrome, and Flatpak sandboxes. Revert the file if you need those.

Honesty

Not CISA KEV as of catalog 2026.10.20. CISA SSVC on NVD: exploitation none.[1][4]
CVSS 9.3 is the Linux CNA figure on NVD, not a ServerGurus score. CloudLinux repeats 9.3.[1][6]
Production leak: Vercel says the memory leak was shown on their production sandboxes. Crash and host code execution: Vercel and pwn.ai both place those on researcher-owned KVM/Firecracker, not on a named public-cloud production fleet.[3][5]
No public PoC in CloudLinux’s post. They have not reproduced. pwn.ai says they expect weaker-config exploits “in weeks” and default-hypervisor exploits “in under a month” - that is their forecast, not a report of in-the-wild use.[3][6]
Ubuntu tracker this morning: still Vulnerable on supported linux packages. Debian security has floors; Ubuntu/CloudLinux kernels are not those floors. KernelCare main-feed ID K20261016_0002 is CloudLinux’s claim as of 19 Oct, not a kcarectl we ran on a customer box.[6][8][9]
Mechanism above is the public commit + vendor/researcher write-ups. We are not publishing a packet recipe.

Sources

NVD CVE-2026-99999, fetched 21 Oct 2026 - https://nvd.nist.gov/vuln/detail/CVE-2026-99999
Linux commit 6785011f8b16 - https://github.com/torvalds/linux/commit/6785011f8b16abf40b1e9d8b2e332232b3e68822
pwn.ai, “PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999)” - https://pwn.ai/blog/pwnescape
CISA KEV JSON catalogVersion 2026.10.20 - https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Vercel, “Findings from the $1M Vercel Sandbox challenge,” 14 Oct 2026 - https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge
CloudLinux, “CVE-2026-99999 Guest-to-Host Escape,” date 16 Oct 2026, modified 19 Oct 2026 08:11 UTC - https://blog.cloudlinux.com/cve-2026-99999-guest-to-host-escape
oss-security, Jan Schaumann, 15 Oct 2026 - https://www.openwall.com/lists/oss-security/2026/10/15/5
Ubuntu CVE tracker, fetched 21 Oct 2026 - https://ubuntu.com/security/CVE-2026-99999
Debian security tracker, fetched 21 Oct 2026 - https://security-tracker.debian.org/tracker/CVE-2026-99999