CVE-2026-99999: a critical Linux kernel flaw lets a guest attack the host
A critical IPv4 checksum bug in the Linux kernel lets a guest virtual machine, or any local sender of crafted packets, corrupt the host kernel's memory. The fix is upstream and backported, Red Hat tracks it as an active-exploit case, and there is no mitigation beyond a kernel update.