PWNESCAPE: GUEST-TO-HOST KVM ESCAPE (CVE-2026-99999)

Summary from the TLDR InfoSec newsletter

Researchers found a Linux networking flaw that lets an untrusted VM guest alter IPv4 header bytes after the host kernel validates them. Guest-controlled checksum metadata can change the IPv4 header length, causing the kernel to copy 32 bytes beyond the packet's logical data and transmit them as apparent IP options. In a controlled KVM lab, the disclosure supported selected 64-byte host-kernel writes and execution of a host-root helper. The upstream fix, commit 6785011f8b16, validates checksum_start before checksum completion across five IPv4 consumers.