PWNESCAPE - 0xCYB3R M5K

You don't always have to break the hypervisor to escape the sandbox. Sometimes, you just have to lie to the Linux networking stack. "PWNESCAPE" breaks down the critical CVE-2026-99999 vulnerability. Discovered during Vercel's $1 million sandbox challenge, researchers realized that untrusted guest checksum metadata (CHECKSUM_PARTIAL) could rewrite a validated IPv4 header during deferred processing. By mutating the header length from 20 bytes (0x45) to 60 bytes (0x4f), attackers forced the kernel to read 32 bytes of out-of-bounds host memory as IP options. This "deferred-metadata trust inversion" turned a networking quirk into a full guest-to-host KVM escape. Patch your kernels, and validate your checksum offsets. [LYRICS] You locked the hypervisor tight, thought the boundaries were secure. Hardened beyond the industry standard, of that you were so sure. But isolation isn't just about the monitor in the core. We found a promise to write later, and we opened up the door. A million-dollar challenge on the Vercel sandbox line. We didn't break KVM, we just redefined the design. Looking past the hypervisor to the Linux networking stack. Where untrusted checksum metadata initiates the attack. CHECKSUM_PARTIAL sitting in the buffer, a promise to write late. The kernel parses the IPv4 header and authorizes the state. But the fragmenter comes calling, and the checksum drops the payload. Rewriting security bytes right in the middle of the road. First byte was 0x45, twenty bytes of header length. We mutated it to 0x4f, sixty bytes to test its strength. The version nibble stays the same, but the interpretation shifts. While the logical linear data completely rips and rifts. Welcome to PwnEscape, breaking through the host!Thirty-two bytes of memory bleeding out the most! Deferred-metadata trust inversion is the name of the game! The hypervisor didn't fail, but we escaped it just the same! You checked the header early, but you let the header change. Now we're executing writes entirely out of range! It’s a time-of-check to time-of-use, but completely deterministic. No thread races needed when the logic is linguistic. Host ingress parses the packet, fragment processing takes the lead. Then skb_checksum_help fulfills the untrusted seed. ip_do_fragment reads a header claiming sixty bytes are there. Pulling host data as IP options, pulling secrets out of thin air. Three days to find the primitive inside the Omega-Pwn harness. Turning host-memory disclosure into something entirely lawless. Welcome to PwnEscape, breaking through the host!Thirty-two bytes of memory bleeding out the most! Deferred-metadata trust inversion is the name of the game! The hypervisor didn't fail, but we escaped it just the same! You checked the header early, but you let the header change. Now we're executing writes entirely out of range! Validate checksum_start before you complete the write. ip_check_csum_start will help you sleep at night. Guest-to-host KVM escape. CVE-2026-99999.