Linux Kernel IPv4 skb_checksum_help Out-of-Bounds Write via Virtio-Net Checksum Metadata (PwnEscape)

#!/bin/bash
# CVE-2026-99999 (PwnEscape) Vulnerability Checker
# Checks if the running kernel is patched against the IPv4
# skb_checksum_help OOB write (guest-to-host escape).
# Exit codes: 0=PATCHED  1=VULNERABLE  2=UNKNOWN

set -euo pipefail

KVER=$(uname -r)
UPSTREAM=$(echo "$KVER" | grep -oP '^\d+\.\d+\.\d+' || true)

if [[ -z "$UPSTREAM" ]]; then
    echo "UNKNOWN — could not parse kernel version from: $KVER"
    exit 2
fi

MAJOR=$(echo "$UPSTREAM" | cut -d. -f1)
MINOR=$(echo "$UPSTREAM" | cut -d. -f2)
BRANCH="${MAJOR}.${MINOR}"

# version_gte: returns 0 if $1 >= $2 (GNU sort -V)
version_gte() { printf '%s\n%s' "$2" "$1" | sort -V -C 2>/dev/null; }

# Pre-vulnerable check: code introduced in 2.6.27
if ! version_gte "$UPSTREAM" "2.6.27"; then
    echo "PATCHED — $KVER predates vulnerable code (introduced 2.6.27)"
    exit 0
fi

# Fixed versions per stable branch
case "$BRANCH" in
    5.10) FIXED="5.10.272" ;;
    5.15) FIXED="5.15.223" ;;
    6.1)  FIXED="6.1.190"  ;;
    6.6)  FIXED="6.6.159"  ;;
    6.12) FIXED="6.12.113" ;;
    6.18) FIXED="6.18.57"  ;;
    7.2)  FIXED="7.2.11"   ;;
    7.3|7.[4-9]*|[8-9].*)
        echo "PATCHED — $KVER is branch $BRANCH (fix merged in 7.3-rc7)"
        exit 0 ;;
    *)    FIXED="" ;;
esac

if [[ -n "$FIXED" ]]; then
    if version_gte "$UPSTREAM" "$FIXED"; then
        echo "PATCHED — $KVER (upstream $UPSTREAM >= $FIXED)"
        exit 0
    else
        echo "VULNERABLE — $KVER (upstream $UPSTREAM < $FIXED on $BRANCH)"
        exit 1
    fi
fi

# Check for distro backport via package version
if command -v rpm &>/dev/null; then
    PKG=$(rpm -q --qf '%{VERSION}-%{RELEASE}' kernel-"$(uname -r)" 2>/dev/null || true)
    if [[ -n "$PKG" ]]; then
        # RHEL 8 fixed: 4.18.0-553.174.2  RHEL 9 fixed: 5.14.0-687.57.2
        case "$BRANCH" in
            4.18) version_gte "$UPSTREAM" "4.18.0" && \
                  echo "$PKG" | grep -qP '553\.17[4-9]|553\.[2-9][0-9]{2}|55[4-9]|5[6-9]|[6-9]' && \
                  { echo "PATCHED — RHEL/Alma 8 backport detected ($PKG)"; exit 0; } ;;
            5.14) version_gte "$UPSTREAM" "5.14.0" && \
                  echo "$PKG" | grep -qP '687\.5[7-9]|687\.[6-9]|68[8-9]|69|[7-9]' && \
                  { echo "PATCHED — RHEL/Alma 9 backport detected ($PKG)"; exit 0; } ;;
        esac
    fi
fi

# Check KernelCare livepatch
if command -v kcarectl &>/dev/null; then
    if kcarectl --patch-info 2>/dev/null | grep -qi 'CVE-2026-99999'; then
        echo "PATCHED — KernelCare livepatch for CVE-2026-99999 on $KVER"
        exit 0
    fi
fi

# Unknown / EOL branch
echo "UNKNOWN — $KVER on branch $BRANCH (not a current LTS). Check your distro vendor."
exit 2