Loading vulnerability…
PwnEscape is a Linux kernel IPv4 checksum-metadata validation vulnerability introduced in Linux 2.6.27. Insufficient validation of CHECKSUM_PARTIAL metadata allows skb_checksum_help() to write into an IPv4 header after earlier parsing, routing, and policy decisions have trusted it. Guest-influenced checksum-start and checksum-offset values can therefore modify security-sensitive header fields during deferred checksum completion. In a demonstrated fragmentation path, the write increased the interpreted IPv4 header length from 20 to 60 bytes, causing subsequent processing to copy beyond valid packet data and disclose 32 bytes of host memory. This is a deterministic validation/use inconsistency, not a concurrency-dependent race. The flaw resides in host Linux networking rather than a particular hypervisor and can enable host-memory disclosure, denial of service, and guest-to-host escape.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No valid public exploits. Mallory filtered out 7 candidates as fakes, detection scripts, or README-only repos.
All candidate exploits were filtered out by Mallory's validation.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
274 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical, 9.3-rated Linux networking vulnerability described as enabling guest-to-host escape in KVM environments. Untrusted checksum metadata can cause skb_checksum_help to modify security-sensitive packet headers after validation, undermining isolation. Potential impacts include host arbitrary code execution, denial of service, and sensitive-memory disclosure. An upstream Linux kernel fix exists and is being incorporated into distributions.
A Linux kernel IPv4 checksum-validation flaw allows a local attacker or untrusted guest virtual machine to trigger an out-of-bounds write using malformed packet checksum metadata. Potential consequences include host arbitrary code execution, denial of service, and sensitive kernel-memory disclosure. The content reports active exploitation. Red Hat rates it Important, with CVSS 3.1 8.8, versus CVE.org's 9.3; the difference concerns privileges required. No Red Hat fixes or qualifying mitigations are available in the supplied advisory; fixes are being pursued.
A vulnerability affecting the Fedora 43 kernel, addressed by the kernel 7.2.11 stable updates under advisory FEDORA-2026-3057544965. The plugin assigns a critical CVSS v3 score of 9.3, with a local attack vector and high confidentiality, integrity, and availability impacts. The underlying flaw is not described. Nessus identifies exposure using the installed package's self-reported version rather than testing exploitation.
A vulnerability affecting the Fedora 44 kernel, referenced by security advisory FEDORA-2026-1a3e2d0ffe. The plugin reports a critical CVSS v3 base score of 9.3, with local access required and potentially high confidentiality, integrity, and availability impacts. The underlying flaw is not described. Nessus identifies exposure using the application's self-reported version rather than testing exploitation.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.