Virtual machine escape vulnerability affecting the Linux kernel

The Linux kernel forms the heart of the operating system for many distributions deployed in virtual, physical, and cloud environments. This component is affected by a vulnerability labeled CVE-2026-99999 due to insufficient validation of the checksum_start parameter when calculating the checksum of IPv4 packets in the Linux kernel. Exploitation of this vulnerability would allow a local attacker, or rogue virtual machine guest, to transmit specially crafted packets that could cause memory corruption, arbitrary code execution, or denial of service on the affected system. It is classified critical with a severity score of 9.3 according to CVSS V3.1.

• All versions of the Linux kernel (from version 2.6.27):;
• branch 5.10.x before 5.10.272;
• branch 5.15.x before 5.15.223;
• branch 6.1.x before 6.1.190;
• branch 6.6.x before 6.6.159;
• branch 6.12.x before 6.12.113;
• branch 6.18.x before 6.18.57;
• branch 7.2.x before 7.2.11;
• Debian (linux source package):;
• bookworm (12) before 6.1.190-1;
• trixie (13) before 6.12.113-1;
• forky/sid before 7.2.11-1;
• AlmaLinux:;
• AlmaLinux 8 before kernel-4.18.0-553.174.2.el8_10;
• AlmaLinux 9 before kernel-5.14.0-687.57.2.el9_8;
• AlmaLinux 10 before kernel-6.12.0-211.66.2.el10_2;
• Red Hat Enterprise Linux (kernel and kernel-rt packages) and Red Hat In‑Vehicle OS;