Critical Linux Kernel Flaw PwnEscape Let Guest VMs Read Host Memory, Researcher Shows

A newly disclosed critical flaw in the Linux kernel lets code running inside a virtual machine read memory on the host machine beneath it. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it.

Tracked as CVE-2026-99999 and nicknamed PwnEscape, the flaw sits in the Linux kernel's networking code rather than in any single cloud provider's setup, putting it in the shared layer that keeps customers' workloads apart. It was uncovered during a Vercel security challenge and reported privately before any public release. There is no sign it has been used in a real attack.

Paulos Yibelo of the security firm pwn.ai found that specially crafted network packets sent from inside a virtual machine could read the host's memory, crash the host, and run code on it, according to his technical write-up. Vercel said the memory leak was shown against its production sandboxes, with each packet carrying back roughly 32 bytes of host memory for as long as the guest kept sending. The crash and code execution were seen only on the researcher's own machines, configured to match Vercel's. Two crafted packets were enough to crash a host and take down every sandbox on it. Yibelo then reached administrator control of a host in the lab, which he stressed was "not a claim of root command execution in any vendor's production environment." Vercel said no report in the challenge showed anyone reading a customer's files, secrets, or application data.

Kernel maintainers rated the flaw 9.3 out of 10, or Critical, in the published record, though the U.S. National Vulnerability Database had not finished its own review. The attack vector is listed as local, meaning an attacker must already be running code inside a guest. It is not in CISA's catalog of actively exploited vulnerabilities, and no real-world use has been reported.

Vercel Sandbox runs each customer's code in its own Firecracker microVM on bare-metal Amazon EC2 hosts. The flaw is not in that isolation layer but in the host's Linux kernel networking code. pwn.ai said Vercel's sandbox was already hardened beyond normal industry standards, with no misconfiguration it could find. Because most large clouds separate workloads at that same kernel layer, Vercel said a flaw there threatens shared infrastructure rather than one provider.

The fix is a single kernel change, commit 6785011f8b16, written by Red Hat's Michael S. Tsirkin and merged into mainline. It adds a check that a packet's checksum data cannot point into the IPv4 header, applied at five places in the networking code. Its author calls it "a defence in depth measure" and notes a fuller check on packet entry still needs work. Fixed versions by branch: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, and 7.2.11. Distributions often backport such fixes without changing version numbers, so check your vendor's advisory and whether the host's running kernel actually includes it.

Update the host kernel to a fixed version or a vendor build containing the fix, then reboot into it. Updating only a guest's kernel does not fix the host, and the sources offer no separate workaround if patching must wait. Where patching is delayed, Vercel said it keeps host kernels current, disables nested virtualization, and runs each microVM under Firecracker's jailer, which limits the process to needed permissions. That does not fix the flaw but narrows what an attacker could do.

The flaw surfaced in a two-week Vercel challenge in August offering up to $1 million total to anyone who could break out of its sandbox. No single payout hit that figure; the top reward per report was $50,000, and Vercel paid $242,000 across 1,285 reports, with this the one Critical finding. pwn.ai said it found the flaw in three days using its own AI-assisted research system, with the model analyzing source code and human researchers directing the work, at a cost under $700 in API tokens.

Source: The Hackers News