cve-2026-99999-scanner.git

cve-2026-99999-scanner

~ Checks whether a Linux system is affected by CVE-2026-99999 (PwnEscape) and prints or applies the distribution-specific kernel fix
git clone https://github.com/debuman/cve-2026-99999-scanner.git

CVE-2026-99999 Scanner

English | 한국어

A single shell script that checks whether a Linux system is affected by CVE-2026-99999 ("PwnEscape"). It explains the verdict, then either prints the patch steps for that distribution or patches and reboots the system for you.

The vendor data embedded in the script is current as of 2026-10-20. Advisories change quickly, so always confirm with your distribution's security tracker.

The vulnerability
Component Linux kernel IPv4 stack (skb_checksum_help → ip_do_fragment)
Cause checksum_start / csum_offset supplied through the virtio-net header or packet sockets is not validated against the IPv4 header. Completing the checksum can then overwrite the already-validated header length (CWE-20).
Impact Guest VM → host: host memory disclosure, host crash, code execution as root on the host
Severity CVSS 3.1 9.3 Critical (kernel CNA) · 8.8 Important (Red Hat)
Affected Every kernel since 2.6.27
Fix Upstream commit 6785011f8b16 "ipv4: validate checksum_start before completing checksum"
Workaround None published. The only fix is to boot a fixed kernel.

The main risk is to virtualization hosts that run untrusted guests (KVM/QEMU, Firecracker, Proxmox, cloud and VPS hosts). Patching a guest's kernel does not protect the host.

Files

File Description
scanner-cve-2026-99999.sh The scanner, English output
scanner-cve-2026-99999_kr.sh The same scanner, Korean output

Both files contain the same logic; only the messages and comments differ.

Checksums (v1.0.0)

File SHA-256 MD5
scanner-cve-2026-99999.sh 65c3c226487d5bd80d436c06cc5256304cfa17011be82d8404c54355998801a6 8ab38c22ed737986775f6f64f5a800aa
scanner-cve-2026-99999_kr.sh 05d4af248ab2cab26566c81067ed35dd0a8c966f7fa8459867597c56ac43a805 6223f8db3c1a8dec361fe301a7193ff4

Verify the file before running it:

echo "65c3c226487d5bd80d436c06cc5256304cfa17011be82d8404c54355998801a6  scanner-cve-2026-99999.sh" | sha256sum -c
echo "8ab38c22ed737986775f6f64f5a800aa  scanner-cve-2026-99999.sh" | md5sum -c

These values are for the files in the v1.0.0 release. Files on later commits may differ.

Quick start

From the release (recommended):

curl -LO https://github.com/sqzer-x/cve-2026-99999-scanner/releases/download/v1.0.0/scanner-cve-2026-99999.sh
echo "65c3c226487d5bd80d436c06cc5256304cfa17011be82d8404c54355998801a6  scanner-cve-2026-99999.sh" | sha256sum -c
sudo bash scanner-cve-2026-99999.sh

Or from the repository:

git clone https://github.com/sqzer-x/cve-2026-99999-scanner.git
cd cve-2026-99999-scanner
sudo bash scanner-cve-2026-99999.sh

Run it on the host, not inside a container. Checking works as a regular user; root (through sudo) is only needed for menu option 1.

What it does

  1. Detects the distribution (/etc/os-release) and the running kernel (/proc).

  2. Judges the kernel:

    • against the fixed versions published by the vendor (AlmaLinux, Oracle UEK, Amazon Linux, Debian), or
    • against the upstream stable fixed versions (Fedora, Arch, openSUSE Tumbleweed, Alpine, Gentoo, WSL2, ...), or
    • for distributions that have not released a fix yet (RHEL family, Ubuntu, SUSE), by searching the installed kernel package changelog for the CVE id or the fix commit — so a fix released after 2026-10-20 is still recognized.

  3. Checks for an applied livepatch (kpatch, Canonical Livepatch, SUSE kernel-livepatch, Ksplice), a fixed kernel that is installed but not booted yet, and whether the next boot kernel is fixed.

  4. Reports exposure indicators: /dev/kvm, vhost_net, TUN/TAP devices, VM processes (QEMU, Firecracker, Proxmox kvm, ...), user namespace settings.

  5. If the system is not safe, offers a menu:

    1. Patch now (install the fixed kernel and reboot)
2. Patch manually later (show the commands)
3. Exit

    When not run from a terminal (cron, pipes, output redirected to a file), no menu is shown and it behaves like option 2.

Options

Option Description
-l, --list Print only the per-distribution status table
--no-color Disable colored output (NO_COLOR is honored too)
--os-release FILE Use this os-release file instead of /etc/os-release
--uname-r STRING Judge this kernel release instead of the running one (skips local checks)
--uname-v STRING Kernel build string (uname -v), needed for Debian kernels with --uname-r
-h, --help Show help

Exit codes

Code Meaning
0 Safe (fixed, not affected, or livepatched)
1 Vulnerable — a fixed kernel is available
2 Fixed kernel installed — reboot needed
3 Vulnerable — no vendor fix yet, or end of life
4 Undetermined (unknown kernel, running inside a container, ...)

The exit codes make it usable from configuration management or monitoring:

bash scanner-cve-2026-99999.sh --no-color > report.txt; echo "exit code: $?"

Checking another server

The verdict can be computed for values collected elsewhere, for example from a container or an inventory:

# On the target:  uname -r ; uname -v ; cat /etc/os-release > os-release.txt
bash scanner-cve-2026-99999.sh --uname-r 5.14.0-570.12.1.el9_6.x86_64 --os-release os-release.txt
bash scanner-cve-2026-99999.sh --uname-r 6.1.0-38-amd64 \
     --uname-v '#1 SMP PREEMPT_DYNAMIC Debian 6.1.176-1 (2026-08-02)' --os-release os-release.txt

Status by distribution (as of 2026-10-20)

bash scanner-cve-2026-99999.sh --list prints the same table.

Distribution Status Fixed version
Upstream (kernel.org) Fixed 5.10.272 · 5.15.223 · 6.1.190 · 6.6.159 · 6.12.113 · 6.18.57 · 7.2.11 · 7.3-rc7. Other branches are end of life.
AlmaLinux 8 / 9 / 10 Fixed (almalinux-testing repo, 2026-10-16) kernel-4.18.0-553.174.2.el8_10 · kernel-5.14.0-687.57.2.el9_8 · kernel-6.12.0-211.66.2.el10_2
AlmaLinux Kitten 10 Next regular kernel update —
RHEL 7 / 8 / 9 / 10 Affected, no fix yet —
Rocky Linux, CentOS Stream, other RHEL compatibles No fix published —
Oracle Linux UEK Fixed UEK R6 5.4.17-2136.360.3.1 (ELSA-2026-500397) · UEK R7 5.15.0-325.221.6.4 (ELSA-2026-500398) · UEK R8 6.12.0-207.111.5.4 (ELSA-2026-500399)
Oracle Linux RHCK No advisory —
Amazon Linux 2 Fixed 4.14 4.14.355-287.753 (ALAS2-2026-3962) · 5.4 5.4.302-229.498 (ALAS2KERNEL-5.4-2026-131) · 5.10 5.10.269-270.1108 (ALAS2KERNEL-5.10-2026-133) · 5.15 5.15.221-157.262 (ALAS2KERNEL-5.15-2026-117)
Amazon Linux 2023 Fixed kernel 6.1.188-233.385 (ALAS2023-2026-3197) · kernel6.12 6.12.110-135.201 (ALAS2023-2026-3196) · kernel6.18 6.18.54-121.166 (ALAS2023-2026-3192)
Debian Fixed bookworm 6.1.190-1 (DLA-4841-1) · trixie 6.12.113-1 (DSA-6568-1) · forky/sid 7.2.11-1. bullseye and older are not tracked.
Ubuntu 14.04 – 26.04 Needs evaluation, no fix yet —
SLES 12 SP5 / 15 SP4–SP7 / 16.x, SLE Micro, openSUSE Leap 16 Affected, pending —
openSUSE Leap 15.x, SLES 15 SP1–SP3 End of life —
Fedora, Arch, openSUSE Tumbleweed, Alpine, Gentoo Follow upstream stable see the upstream row

AWS states that the EC2, Lambda and Fargate host infrastructure is not affected; Amazon Linux instances still need their own kernel updated.

Safety of "Patch now"

  • Only kernel packages are updated where possible: dnf/yum update 'kernel*', and on Debian/Ubuntu only the installed linux-* packages with --no-remove (packages that were automatically installed keep that mark, so old kernels are still cleaned up by apt autoremove).
  • Full-system upgrade tools keep their own confirmation prompt: pacman -Syu, zypper dup, apk upgrade, transactional-update dup, Proxmox apt-get dist-upgrade.
  • Patching does not start when /boot has less than 100 MB free.
  • It reboots only after confirming that the next boot kernel is fixed (the grubby default, otherwise the newest installed kernel, or the next btrfs snapshot on SLE Micro / MicroOS) and that its kernel image and initramfs exist.
  • Before rebooting there is a 10-second countdown; Enter or Ctrl-D cancels. Typing yes is required instead when VMs are running, when GRUB_DEFAULT is not 0, or when bash is not available.
  • On AlmaLinux the testing repository is used once and its repository package is removed afterwards.
  • It never reboots inside WSL.

Air-gapped environments

  • Detection needs no network access and gives the same result with the network cut off.
  • Option 1 needs a package repository that the server can reach, such as an internal mirror. Without one, the update fails safely: no reboot, and the manual steps are printed.

Requirements

  • Linux with bash, awk, sed, grep and coreutils. When started with sh, the script re-runs itself under bash.
  • Optional, used when present: rpm / dpkg, systemd-detect-virt, grubby, gzip, stat, df, btrfs.

Limitations

  • The fixed-version tables are a snapshot of vendor advisories as of 2026-10-20.
  • For distributions not listed above, the verdict is estimated from upstream version numbers; vendors may have backported the fix without changing the version.
  • Changelog-based detection relies on the vendor listing the CVE id or the fix commit title in the kernel changelog.
  • On GRUB systems without grubby, the newest installed kernel is assumed to boot next (GRUB_DEFAULT=0).
  • Test option 1 on a disposable machine of the same distribution before using it in production.
  • This tool is provided as is, without warranty. You are responsible for changes made to your systems.

References