cve-2026-99999-scanner

 # CVE-2026-99999 Scanner
 
 **English** | [한국어](README_kr.md)
 
 A single shell script that checks whether a Linux system is affected by **CVE-2026-99999 ("PwnEscape")**. It explains the verdict, then either prints the patch steps for that distribution or patches and reboots the system for you.
 
 > The vendor data embedded in the script is current as of **2026-10-20**. Advisories change quickly, so always confirm with your distribution's security tracker.
 
 ## The vulnerability
 
 | | |
 |---|---|
 | Component | Linux kernel IPv4 stack (`skb_checksum_help` → `ip_do_fragment`) |
 | Cause | `checksum_start` / `csum_offset` supplied through the virtio-net header or packet sockets is not validated against the IPv4 header. Completing the checksum can then overwrite the already-validated header length (CWE-20). |
 | Impact | Guest VM → host: host memory disclosure, host crash, code execution as root on the host |
 | Severity | CVSS 3.1 **9.3 Critical** (kernel CNA) · 8.8 Important (Red Hat) |
 | Affected | Every kernel since 2.6.27 |
 | Fix | Upstream commit [`6785011f8b16`](https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822) "ipv4: validate checksum_start before completing checksum" |
 | Workaround | None published. The only fix is to boot a fixed kernel. |
 
 The main risk is to **virtualization hosts** that run untrusted guests (KVM/QEMU, Firecracker, Proxmox, cloud and VPS hosts). Patching a guest's kernel does not protect the host.
 
 ## Files
 
 | File | Description |
 |---|---|
 | `scanner-cve-2026-99999.sh` | The scanner, English output |
 | `scanner-cve-2026-99999_kr.sh` | The same scanner, Korean output |
 
 Both files contain the same logic; only the messages and comments differ.
 
 ## Checksums (v1.0.0)
 
 | File | SHA-256 | MD5 |
 |---|---|---|
 | `scanner-cve-2026-99999.sh` | `65c3c226487d5bd80d436c06cc5256304cfa17011be82d8404c54355998801a6` | `8ab38c22ed737986775f6f64f5a800aa` |
 | `scanner-cve-2026-99999_kr.sh` | `05d4af248ab2cab26566c81067ed35dd0a8c966f7fa8459867597c56ac43a805` | `6223f8db3c1a8dec361fe301a7193ff4` |
 
 Verify the file before running it:
 
 ```bash
 echo "65c3c226487d5bd80d436c06cc5256304cfa17011be82d8404c54355998801a6  scanner-cve-2026-99999.sh" | sha256sum -c
 echo "8ab38c22ed737986775f6f64f5a800aa  scanner-cve-2026-99999.sh" | md5sum -c
 ```
 
 These values are for the files in the [v1.0.0 release](https://github.com/sqzer-x/cve-2026-99999-scanner/releases/tag/v1.0.0). Files on later commits may differ.
 
 ## Quick start
 
 From the release (recommended):
 
 ```bash
 curl -LO https://github.com/sqzer-x/cve-2026-99999-scanner/releases/download/v1.0.0/scanner-cve-2026-99999.sh
 echo "65c3c226487d5bd80d436c06cc5256304cfa17011be82d8404c54355998801a6  scanner-cve-2026-99999.sh" | sha256sum -c
 sudo bash scanner-cve-2026-99999.sh
 ```
 
 Or from the repository:
 
 ```bash
 git clone https://github.com/sqzer-x/cve-2026-99999-scanner.git
 cd cve-2026-99999-scanner
 sudo bash scanner-cve-2026-99999.sh
 ```
 
 Run it on the **host**, not inside a container. Checking works as a regular user; root (through `sudo`) is only needed for menu option 1.
 
 ## What it does
 
 1. Detects the distribution (`/etc/os-release`) and the running kernel (`/proc`).
 2. Judges the kernel:
    - against the fixed versions published by the vendor (AlmaLinux, Oracle UEK, Amazon Linux, Debian), or
    - against the upstream stable fixed versions (Fedora, Arch, openSUSE Tumbleweed, Alpine, Gentoo, WSL2, ...), or
    - for distributions that have not released a fix yet (RHEL family, Ubuntu, SUSE), by searching the installed kernel package changelog for the CVE id or the fix commit — so a fix released after 2026-10-20 is still recognized.
 3. Checks for an applied livepatch (kpatch, Canonical Livepatch, SUSE kernel-livepatch, Ksplice), a fixed kernel that is installed but not booted yet, and whether the next boot kernel is fixed.
 4. Reports exposure indicators: `/dev/kvm`, `vhost_net`, TUN/TAP devices, VM processes (QEMU, Firecracker, Proxmox `kvm`, ...), user namespace settings.
 5. If the system is not safe, offers a menu:
 
    ```
    1. Patch now (install the fixed kernel and reboot)
    2. Patch manually later (show the commands)
    3. Exit
    ```
 
    When not run from a terminal (cron, pipes, output redirected to a file), no menu is shown and it behaves like option 2.
 
 ## Options
 
 | Option | Description |
 |---|---|
 | `-l`, `--list` | Print only the per-distribution status table |
 | `--no-color` | Disable colored output (`NO_COLOR` is honored too) |
 | `--os-release FILE` | Use this os-release file instead of `/etc/os-release` |
 | `--uname-r STRING` | Judge this kernel release instead of the running one (skips local checks) |
 | `--uname-v STRING` | Kernel build string (`uname -v`), needed for Debian kernels with `--uname-r` |
 | `-h`, `--help` | Show help |
 
 ## Exit codes
 
 | Code | Meaning |
 |---|---|
 | 0 | Safe (fixed, not affected, or livepatched) |
 | 1 | Vulnerable — a fixed kernel is available |
 | 2 | Fixed kernel installed — reboot needed |
 | 3 | Vulnerable — no vendor fix yet, or end of life |
 | 4 | Undetermined (unknown kernel, running inside a container, ...) |
 
 The exit codes make it usable from configuration management or monitoring:
 
 ```bash
 bash scanner-cve-2026-99999.sh --no-color > report.txt; echo "exit code: $?"
 ```
 
 ## Checking another server
 
 The verdict can be computed for values collected elsewhere, for example from a container or an inventory:
 
 ```bash
 # On the target:  uname -r ; uname -v ; cat /etc/os-release > os-release.txt
 bash scanner-cve-2026-99999.sh --uname-r 5.14.0-570.12.1.el9_6.x86_64 --os-release os-release.txt
 bash scanner-cve-2026-99999.sh --uname-r 6.1.0-38-amd64 \
      --uname-v '#1 SMP PREEMPT_DYNAMIC Debian 6.1.176-1 (2026-08-02)' --os-release os-release.txt
 ```
 
 ## Status by distribution (as of 2026-10-20)
 
 `bash scanner-cve-2026-99999.sh --list` prints the same table.
 
 | Distribution | Status | Fixed version |
 |---|---|---|
 | Upstream (kernel.org) | Fixed | 5.10.272 · 5.15.223 · 6.1.190 · 6.6.159 · 6.12.113 · 6.18.57 · 7.2.11 · 7.3-rc7. Other branches are end of life. |
 | AlmaLinux 8 / 9 / 10 | Fixed (almalinux-testing repo, 2026-10-16) | `kernel-4.18.0-553.174.2.el8_10` · `kernel-5.14.0-687.57.2.el9_8` · `kernel-6.12.0-211.66.2.el10_2` |
 | AlmaLinux Kitten 10 | Next regular kernel update | — |
 | RHEL 7 / 8 / 9 / 10 | Affected, no fix yet | — |
 | Rocky Linux, CentOS Stream, other RHEL compatibles | No fix published | — |
 | Oracle Linux UEK | Fixed | UEK R6 `5.4.17-2136.360.3.1` (ELSA-2026-500397) · UEK R7 `5.15.0-325.221.6.4` (ELSA-2026-500398) · UEK R8 `6.12.0-207.111.5.4` (ELSA-2026-500399) |
 | Oracle Linux RHCK | No advisory | — |
 | Amazon Linux 2 | Fixed | 4.14 `4.14.355-287.753` (ALAS2-2026-3962) · 5.4 `5.4.302-229.498` (ALAS2KERNEL-5.4-2026-131) · 5.10 `5.10.269-270.1108` (ALAS2KERNEL-5.10-2026-133) · 5.15 `5.15.221-157.262` (ALAS2KERNEL-5.15-2026-117) |
 | Amazon Linux 2023 | Fixed | kernel `6.1.188-233.385` (ALAS2023-2026-3197) · kernel6.12 `6.12.110-135.201` (ALAS2023-2026-3196) · kernel6.18 `6.18.54-121.166` (ALAS2023-2026-3192) |
 | Debian | Fixed | bookworm `6.1.190-1` (DLA-4841-1) · trixie `6.12.113-1` (DSA-6568-1) · forky/sid `7.2.11-1`. bullseye and older are not tracked. |
 | Ubuntu 14.04 – 26.04 | Needs evaluation, no fix yet | — |
 | SLES 12 SP5 / 15 SP4–SP7 / 16.x, SLE Micro, openSUSE Leap 16 | Affected, pending | — |
 | openSUSE Leap 15.x, SLES 15 SP1–SP3 | End of life | — |
 | Fedora, Arch, openSUSE Tumbleweed, Alpine, Gentoo | Follow upstream stable | see the upstream row |
 
 AWS states that the EC2, Lambda and Fargate host infrastructure is not affected; Amazon Linux instances still need their own kernel updated.
 
 ## Safety of "Patch now"
 
 - Only kernel packages are updated where possible: `dnf`/`yum update 'kernel*'`, and on Debian/Ubuntu only the installed `linux-*` packages with `--no-remove` (packages that were automatically installed keep that mark, so old kernels are still cleaned up by `apt autoremove`).
 - Full-system upgrade tools keep their own confirmation prompt: `pacman -Syu`, `zypper dup`, `apk upgrade`, `transactional-update dup`, Proxmox `apt-get dist-upgrade`.
 - Patching does not start when `/boot` has less than 100 MB free.
 - It reboots only after confirming that the **next boot kernel** is fixed (the `grubby` default, otherwise the newest installed kernel, or the next btrfs snapshot on SLE Micro / MicroOS) and that its kernel image and initramfs exist.
 - Before rebooting there is a 10-second countdown; Enter or Ctrl-D cancels. Typing `yes` is required instead when VMs are running, when `GRUB_DEFAULT` is not `0`, or when bash is not available.
 - On AlmaLinux the testing repository is used once and its repository package is removed afterwards.
 - It never reboots inside WSL.
 
 ## Air-gapped environments
 
 - Detection needs no network access and gives the same result with the network cut off.
 - Option 1 needs a package repository that the server can reach, such as an internal mirror. Without one, the update fails safely: no reboot, and the manual steps are printed.
 
 ## Requirements
 
 - Linux with `bash`, `awk`, `sed`, `grep` and coreutils. When started with `sh`, the script re-runs itself under `bash`.
 - Optional, used when present: `rpm` / `dpkg`, `systemd-detect-virt`, `grubby`, `gzip`, `stat`, `df`, `btrfs`.
 
 ## Limitations
 
 - The fixed-version tables are a snapshot of vendor advisories as of 2026-10-20.
 - For distributions not listed above, the verdict is estimated from upstream version numbers; vendors may have backported the fix without changing the version.
 - Changelog-based detection relies on the vendor listing the CVE id or the fix commit title in the kernel changelog.
 - On GRUB systems without `grubby`, the newest installed kernel is assumed to boot next (`GRUB_DEFAULT=0`).
 - Test option 1 on a disposable machine of the same distribution before using it in production.
 - This tool is provided as is, without warranty. You are responsible for changes made to your systems.
 
 ## References
 
 - CVE record: https://www.cve.org/CVERecord?id=CVE-2026-99999
 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-99999
 - Researcher write-up: https://pwn.ai/blog/pwnescape
 - AlmaLinux: https://almalinux.org/blog/2026-10-16-pwnescape-cve-2026-99999/
 - Analysis: https://www.penligent.ai/hackinglabs/cve-2026-99999/
 - Summary (Korean): https://news.hada.io/topic?id=35568
 - Debian: https://security-tracker.debian.org/tracker/CVE-2026-99999
 - Ubuntu: https://ubuntu.com/security/CVE-2026-99999
 - Red Hat: https://access.redhat.com/security/cve/cve-2026-99999
 - SUSE: https://www.suse.com/security/cve/CVE-2026-99999.html
 - Amazon Linux: https://explore.alas.aws.amazon.com/CVE-2026-99999.html
 - Oracle Linux: https://linux.oracle.com/cve/CVE-2026-99999.html