# PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999)

Guest-controlled CHECKSUM_PARTIAL metadata let a deferred skb_checksum_help() write rewrite the IPv4 IHL after parsing, leaking 32 bytes of host memory and enabling guest-to-host KVM escape.

- Payout: Research
- Severity: critical
- Program: Linux kernel
- Credited: PWNAI Research, Paulos Yibelo
- Disclosed: 2026-10-15
- CVE: CVE-2026-99999
- Write-up quality: 9/10
- Original: https://pwn.ai/blog/pwnescape
- Library page: https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-pwnescape
- Tags: domain:infra domain:network impact:data-leak impact:privesc kind:research platform:research sev:critical tech:linux technique:chained technique:source-review vuln:info-disclosure vuln:memory-corruption

**Target:** Linux IPv4 fragmentation / virtio-net checksum offload path
**Root cause:** skb->csum_start from untrusted virtio metadata was not validated against the network-header-relative IPv4 header length, so skb_checksum_help() could write into the already-parsed IPv4 header and mutate IHL from 5 to 15 before ip_do_fragment() consumed it.
**Steps:**
1. Craft a guest packet with CHECKSUM_PARTIAL metadata whose csum_start points inside the IPv4 header (frame-relative check passes but network-relative check would fail).
2. Deliver via virtio-net so __virtio_net_hdr_to_skb() installs the metadata; host parses IPv4 with IHL=5 (0x45).
3. Trigger output fragmentation so ip_do_fragment() calls skb_checksum_help() before reading ip_hdr().
4. Deferred write mutates first header byte to 0x4f (IHL=15, 60-byte header).
5. Fragmenter copies 60 bytes from a 28-byte logical linear head, emitting 32 bytes of host memory as IP options in outgoing fragments.
6. Observe leaked bytes at application layer and via raw packet capture; compare against sender guard data to confirm host-origin disclosure.
**How found:** Hypothesis that sandbox security extends beyond KVM into host networking; searched for places where untrusted state is promoted to trusted state and later consumers re-trust it. Noticed CHECKSUM_PARTIAL is a deferred write authorized by metadata, and that frame-relative vs network-header-relative offsets diverge after L2 decapsulation, so a deferred write could land in an already-validated IPv4 header.
**Exploitation:** Guest sends malformed checksum metadata; host stack parses a 20-byte IPv4 header, then a deferred checksum completion rewrites IHL to 15, causing the fragmenter to copy 60 bytes from a 28-byte linear head and transmit 32 bytes of host memory as IP options. In an owned KVM fixture, host-memory observations plus controlled allocation yielded selected 64-byte host-kernel writes, used to execute a host-root helper and return a marker to the guest across four cold boots.
**Escalation:** Repeatable read primitive used to resolve host memory state, then combined with allocator grooming to obtain targeted 64-byte kernel writes and a bounded host-root execution chain.
**Insight:** Audit deferred-write metadata (csum_start/csum_offset, GSO, offload hints) for whether its target is validated in the same coordinate space the later consumer uses; frame-relative checks don't survive L2 decapsulation, so a write can mutate fields (like IPv4 IHL) that were already parsed and trusted.