PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999) · updates https://pwn.watch/i/pwnescape-cve-2026-99999 Paulos Yibelo / pwn.ai found a Critical Linux networking flaw (CVE-2026-99999, CVSS 9.3) during Vercel’s $1M Sandbox challenge. Guest-controlled checksum metadata can rewrite an IPv4 header after validation, enabling host-memory disclosure and, in lab conditions, guest-to-host code execution on KVM/Firecracker. Upstream fix merged Oct 2026; host kernels need patch + reboot. Affects multi-tenant VPS / sandbox providers more than end-user desktops. Fly.io published an Oct 16 2026 postmortem of a ~10-hour fleet-wide host reboot after the CVE, saying customer data exposure was unlikely but advising rotation of credentials sent over HTTP or unencrypted 6PN between Oct 15 and 17. en Fri, 06 Nov 2026 00:00:00 GMT PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999): Hacker News discusses Fly.io's PwnEscape postmortem (Well, That Wasn't Fun). https://pwn.watch/i/pwnescape-cve-2026-99999 https://pwn.watch/i/pwnescape-cve-2026-99999#2026-11-06-a7a4a940 Fri, 06 Nov 2026 00:00:00 GMT critical <p><a href="https://news.ycombinator.com/item?id=50397310">Source</a></p> PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999): Fly.io begins an emergency fleet-wide host reboot for CVE-2026-99999 (PwnEscape), completing the patched-kernel rollout in about 10 hours; later postmortem says customer data exposure was unlikely but advises rotating credentials sent over HTTP or unencrypted 6PN Oct 15–17. https://pwn.watch/i/pwnescape-cve-2026-99999 https://pwn.watch/i/pwnescape-cve-2026-99999#2026-10-16-809e1ee4 Fri, 16 Oct 2026 00:00:00 GMT critical <p><a href="https://fly.io/blog/well-that-wasnt-fun/">Source</a></p> PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999): Mainline merge / public write-ups. https://pwn.watch/i/pwnescape-cve-2026-99999 https://pwn.watch/i/pwnescape-cve-2026-99999#2026-10-14-f2d6c8e7 Wed, 14 Oct 2026 00:00:00 GMT critical <p>PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999): Mainline merge / public write-ups.</p> PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999): Upstream IPv4 checksum guard accepted into net.git. https://pwn.watch/i/pwnescape-cve-2026-99999 https://pwn.watch/i/pwnescape-cve-2026-99999#2026-10-07-077badd6 Wed, 07 Oct 2026 00:00:00 GMT critical <p>PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999): Upstream IPv4 checksum guard accepted into net.git.</p> PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999): Initial host-memory disclosure reported. https://pwn.watch/i/pwnescape-cve-2026-99999 https://pwn.watch/i/pwnescape-cve-2026-99999#2026-08-20-916282cf Thu, 20 Aug 2026 00:00:00 GMT critical <p>PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999): Initial host-memory disclosure reported.</p> PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999): Vercel Sandbox challenge opens. https://pwn.watch/i/pwnescape-cve-2026-99999 https://pwn.watch/i/pwnescape-cve-2026-99999#2026-08-18-db4d8d8c Tue, 18 Aug 2026 00:00:00 GMT critical <p>PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999): Vercel Sandbox challenge opens.</p>