CVE-2026-99999: pwnescape -- bug in IP checksumming allows KVM priviledge escalation

[Pavel Machek <pavel@nabladev.com>]

[-- Attachment #1: Type: text/plain, Size: 1410 bytes --]

Hi!

There's a new CVE, with a nice name and nice number. If you are
running untrusted code in KVM sandbox (you really should not) this is
important for you, and you should really let us know ASAP.

Description from security researchers is at
https://pwn.ai/blog/pwnescape . Logo is not too cool this time.

Commit 6785011f8b16abf40b1e9d8b2e332232b3e68822 "ipv4: validate
checksum_start before completing checksum" in mainline should stop the
exploit, but states more work is pending:

"We really shouldn't allow such packets in, but as a defence
in depth measure, let's also check before we complete the checksum.

A more complete validation at input is forthcoming, but needs more work."

Stable kernels should be fixed, down to 5.10.272; that was released on
Oct 15. Unfortunately, we did releases soon after that, so the fix is
not there:

v6.12.112-cip33: does not contain the fix
linux-6.1.y-cip: does not contain the fix
v5.10.271-cip78: does not contain the fix

I believe we don't need to do early -cip-rt releases for this.

I'd be inclined not to do early -cip releases, either, but that is
less clear, and others feel otherwise (on irc: iwamatsu> I think a
special release is necessary.). I can help with early -cip releases if
we decide to do them.

If you rely on KVM sandboxing for any -cip or -cip-rt version, please let
us know, and we will simply do the releases.

Best regards,
								Pavel

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]