Summary
Proxmox Virtual Environment (VE) 7.0‑9.x running the Linux kernel with KVM enabled.
Summary
CVE-2026-99999 is a critical guest‑to‑host KVM escape in the Linux kernel’s virtio‑net driver. Exploiting a crafted network packet allows a malicious VM to bypass kernel validation and execute code with host privileges, resulting in full system compromise on the Proxmox host.
Affected Asset
Proxmox Virtual Environment (VE) 7.0‑9.x running the Linux kernel with KVM enabled.
Affected Endpoint
Virtio‑net network device processing checksum metadata in the kernel’s networking stack.
Prerequisites
Proxmox VE host running a vulnerable kernel (pre‑7.0.14‑24‑pve), a VM with virtio‑net enabled, and network access to send crafted packets.
Steps to Reproduce
1. Deploy a VM with virtio‑net on a Proxmox host running a vulnerable kernel.
2. Ensure the guest can send network packets to the host via the virtio‑net interface.
4. Craft a network packet that contains malformed checksum metadata targeting the virtio‑net driver.
5. Transmit the packet to the host; the driver’s incomplete validation triggers a memory‑safety violation.
6. The guest gains host‑level code execution, achieving a full KVM escape.
Evidence
Proxmox Security Advisory PSA‑2026‑00068‑1 (published 2026‑10‑16) describing the flaw, CVE record CVE‑2026‑99999, and the upstream Linux kernel commit that fixed the issue.
Impact
Full guest‑to‑host code execution with root privileges, allowing complete compromise of the Proxmox host, loss of all VMs and data, and potential escape to underlying hardware.
Root Cause
The virtio‑net driver trusts checksum metadata supplied by the guest after kernel validation, enabling a guest‑controlled checksum to corrupt kernel memory and bypass security checks.
Remediation
Upgrade to Proxmox VE kernel version 7.0.14‑24‑pve or later (includes the fix). Apply the kernel live patch if available and restrict network access to trusted networks while disabling unnecessary virtio devices.
Verification Steps
Check kernel version (`uname -r` or `dpkg -l | grep proxmox-kernel`) and confirm it is 7.0.14‑24‑pve or newer.
Reboot the host after upgrading and verify the vulnerability no longer manifests (e.g., attempt packet crafting).
Review system logs for unexpected kernel crashes or privileged access after the upgrade.