CVE-2026-99999 (CVSS 9.3 Critical) is a flaw in how the Linux kernel handles IPv4 checksum metadata from virtio-net. An untrusted virtual machine (VM) guest can overwrite two bytes of an already-validated IPv4 header on the host. The researcher reports a host memory leak, a host crash, and code execution as root on a test host.
No public proof-of-concept exists, and we have not reproduced the attack.
Affected: every supported CloudLinux kernel line is expected to carry the vulnerable code. Hosts that run untrusted VM guests are exposed on every version. Shared hosts without VMs are exposed only where unprivileged users can create user namespaces. Mitigation: partial and untested. Turn off checksum offload for untrusted guests, and disable unprivileged user namespaces to close the local path. Fix status: no fixed kernel has shipped yet. Stream 1, CloudLinux kernel (CloudLinux 7h, 8): in preparation, waiting for the upstream fix. Stream 2, AlmaLinux kernel (CloudLinux 9, 10): waiting for the AlmaLinux fix. Stream 3, TuxCare ELS kernel (CloudLinux 8 LTS, 9 LTS): pending ELS release. Stream 4, KernelCare livepatch: EL9 family released: K20261016_0001: RHEL 9 - in testing K20261016_0002: AlmaLinux 9 and CloudLinux 9 - currently in the main feed K20261016_0004: Oracle Linux 9 - in testing K20261016_0005 / K20261016_0006: Rocky Linux 9 - in testing
Patchsets for other systems still in progress.
Verify:uname -r against the target version, or kcarectl --patch-info | grep CVE-2026-99999
You can find more detailed information on our blog: CVE-2026-99999
Posted Oct 16, 2026 - 17:34 UTC
Update
KernelCare livepatch is currently available in the test feed for the EL9 family and will be released to the main feed later today.
K20261016_0001: RHEL 9 K20261016_0002: AlmaLinux 9 and CloudLinux 9 K20261016_0004: Oracle Linux 9 K20261016_0005 / K20261016_0006: Rocky Linux 9
Posted Oct 16, 2026 - 11:21 UTC
Identified
A vulnerability exists in the Linux kernel’s IPv4 networking code that could allow a malicious virtual machine guest to damage memory within the host kernel by sending specially crafted packets. Remote network access alone is insufficient to exploit this flaw; the attacker must already be able to execute code inside a VM or on the server. Systems running KVM with untrusted virtual machines face the greatest risk.
At this time, no publicly available exploit code has been identified. Technical details have been published in a write-up, and there are no known reports of exploitation in the wild.
Status: - Upstream fix exists. Red Hat has not published its assessment or a fix yet. - We decided not to wait for the vendor here. KernelCare patch is in progress (KCARE-32844), no ETA yet
Affected distros/kernels: CentOS7 3.10 - Vulnerable Debian12 6.1 - Vulnerable Debian13 6.12 - Vulnerable Ubuntu24.04 6.8 - Vulnerable Ubuntu26.04 7.0 - Vulnerable Almalinux8 4.18 - Local Privilege Escalation Possible Almalinux9 5.14 - Local Privilege Escalation Possible Almalinux10 6.12 - Local Privilege Escalation Possible