Exploit for CVE-2026

If a packet with malformed checksum metadata (csum_start pointing into the IPv4 header)

enters the Linux IPv4 stack, `skb_checksum_help()` can corrupt the network header after

initial kernel validation. Subsequent code paths (`ip_do_fragment`, `ip_frag_queue`)

then act on the corrupted header, performing an out-of-bounds memory read and leaking

~32–64 bytes of host kernel heap memory per datagram.

All Linux kernel versions before the fix commits.

Unaffected: 5.10.272+, 5.15.223+, 6.1.190+, 6.12.113+, 6.18.57+, 7.2.11+

- `CVE-2026-99999_pwnescape.py` — PoC (Python 3, no dependencies required)

- `VALIDATION_REPORT.md` — Full code review, bug fixes, and test results

# Show vulnerability explanation (no root required)

python3 CVE-2026-99999_pwnescape.py --explain

# Send 20 datagrams to target (requires root/sudo)

sudo python3 CVE-2026-99999_pwnescape.py 10.0.0.1 -n 20 -f 4 -s 8

| `-n, --num-packets` | Number of datagrams to send | 10 |

| `-f, --fragments` | Fragments per datagram (min 2) | 4 |

| `-s, --last-size` | Last fragment payload size (bytes, 1–1280) | 8 |

| `-i, --iface` | Network interface (e.g. eth0) | auto |

| `-p, --port` | UDP listen port for responses | 31337 |

For **authorised security research** in isolated lab environments ONLY.

Unauthorized use is illegal. Obtain written permission before testing any target.

- **NVD**:

- **Kernel git**: commits `f43798c27684...`, `a464d950f31c...`, `0fab003ef469...`, `94524b7b3269...`, `a65f69e0f38f...`, `32a8b0adaa18...`