Linux Patches a Critical Networking Flaw That Could Cross From a Virtual Machine to Its Host
The Linux kernel project has published a flaw in the kernel's IPv4 networking code as CVE-2026-99999 and scored it 9.3 of a possible 10, critical. The fix is already in the mainline kernel and in seven stable release lines.
The flaw is in the code that completes a packet's checksum, the error-check number carried by network traffic. The kernel project, which issues CVE identifiers for its own code, says in the scoring notes attached to the record that the harm crosses from a guest virtual machine into the host computer running it. That separation is what cloud providers depend on to keep one customer's workload away from another's.
That 9.3 is the kernel project's rating of its own code. The National Vulnerability Database, run by NIST, holds the record but has not yet scored the flaw itself. An enrichment added to the same record by the U.S. cybersecurity agency CISA sets Exploitation to none, the value its framework uses when there is no evidence that a flaw is being exploited.
The record for CVE-2026-99999 was published Oct. 15, 2026, and lists every kernel since 2.6.27 as affected. The severity vector it carries requires local access, but neither privileges nor any action by someone on the host. The fixed releases run from 5.10.272 to 7.2.11, and the original fix landed in mainline 7.3-rc7.
The stable-tree fix commit was written by Michael S. Tsirkin and credits Paulos Yibelo with finding and reporting the problem. Greg Kroah-Hartman signed it into the stable tree.
Tsirkin's commit message calls the change a defense-in-depth measure rather than a full repair. The message says such packets should not reach the IPv4 stack at all, and that a more complete check where they arrive is still being worked on.
