Product Security Alert: "PwnEscape" Vulnerability, CVE-2026-99999

October 26, 2026

On October 21, 2026, Wind River PSIRT was notified of the PwnEscape vulnerability CVE-2026-99999. "In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos and has been reproduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming but,needs more work." The base CVSS (Severity) score is reported at 9.3 (Critical).

Affected Wind River Products

Wind River Linux

Affected component: Kernel

Versions: LTS 22-26

Upstream fix pending. Customers of impacted products should monitor Wind River security and support resources for validated fix availability.

eLxr Pro

Affected component: Kernel

Versions: 12, 12.04, 26.04.02

Upstream fix pending. Customers should monitor eLxr Pro mirror(s) to determine if a fix is available via Kernel updated build to be released to mirror package feeds. Use the command line "apt-get" accessing registered mirror(s).

Wind River Cloud Platform

Affected component: Linux Kernel

Versions: 26.03 and 26.10

Upstream fix pending. Customers should monitor Wind River security and support resources for validated fix availability. Overall impact in this product has been evaluated at Overall CVSS 3.1 (Impact) Score of 8.8 (High).

Wind River Open Stack

Affected component: Linux Kernel

Versions: All versions

Upstream fix pending. Customers should monitor Wind River security and support resources for validated fix availability

Recommended Customer Actions

  1. Apply validated fixes. Customers of impacted products should monitor Wind River security and support resources for validated fixes.

Other Wind River Products

Other Wind River products are not affected by CVE-2026-99999

Wind River Response

Wind River PSIRT will continue to track this vulnerability, coordinate product remediation, and publish relevant updates as additional information becomes available.

For the latest Wind River information, visit the Wind River Security Center.

Additional Resources

Wind River customers who require additional information or assistance should contact Wind River Customer Support or their local Wind River sales representative.

Customers using Wind River software as a component of a third-party device or system should contact the device or system manufacturer for product-specific guidance.