The Debian project has issued a security advisory regarding a critical vulnerability in the Linux kernel, identified as CVE-2026-99999. The flaw, which received a CVSS 3.1 score of 9.3, stems from improper handling of IPv4 checksum metadata within the network stack.
Attackers can exploit this defect to bypass virtual machine isolation. By sending packets with abnormal checksum_start metadata, they can trick the kernel into misinterpreting the size of the IPv4 header, potentially allowing unauthorized memory access and code execution on the host machine.
The vulnerability specifically impacts virtualization environments like KVM, posing significant risks to cloud providers and multi-tenant platforms. The issue is not inherent to KVM itself but resides in the Linux network stack's processing logic.
A fix has been released under patch ID 6785011f8b16, titled 'ipv4: validate checksum_start before completing checksum'. The vulnerability is addressed in Linux kernel versions 6.12.113, 6.18.57, 7.2.11, and 7.3-rc7.
Organizations utilizing Linux-based virtualization, cloud instances, or container sandboxes are advised to update their kernels immediately. This applies particularly to users of Debian, Ubuntu, RHEL, and various public cloud images.
