PwnEscape (CVE-2026-99999): a Linux kernel bug that lets a guest VM read host memory

A critical bug in the Linux kernel's networking stack, nicknamed PwnEscape, lets code running inside a virtual machine leak memory from the host it runs on. Because the bug sits in the host kernel and not in any one provider's sandbox design, it matters to anyone running multi-tenant virtualization on Linux, not only the company where it was found.

What happened

Researcher Paulos Yibelo of pwn.ai found the issue during a sandbox-escape challenge run by Vercel and reported it privately. It is now tracked as CVE-2026-99999. The researcher showed that crafted network packets sent from inside a guest can trigger three different outcomes, all from the same root cause:

• Host memory disclosure. Vercel says this was demonstrated against its production sandboxes. Each outbound packet leaked roughly 32 bytes of host memory, and the guest could keep repeating it.
• Host crash. In a lab built to mirror Vercel's setup, two crafted packets were enough to bring down a host and every sandbox on it.
• Code execution on the host. Also only in the lab: the researcher escaped the VM and gained root on the host. They are explicit that this is not a claim of root execution in any vendor's production environment.

Vercel says no challenge submission showed access to customer files, secrets or application data. There is no report of the bug being used in a real attack, and it is not in CISA's Known Exploited Vulnerabilities catalog.

Severity, read carefully

The kernel's CVE record rates it 9.3 (Critical). NIST's National Vulnerability Database had not finished its own scoring at the time of reporting. The attack vector is local: an attacker must already be running code inside a guest. That is exactly the position of every customer of a cloud sandbox, CI runner or hosted VM platform, which is why "local" understates the risk for multi-tenant operators. For a single-tenant server with no untrusted guests, the risk is much lower.

Why it goes beyond Vercel

Vercel Sandbox runs each workload in a Firecracker microVM with its own kernel, on bare-metal EC2 hosts. The microVM boundary was not the weak point. pwn.ai described the setup as hardened beyond the norm and found no misconfiguration. The flaw is in the host's networking code, the same layer most large clouds rely on to keep tenants apart. Isolation design can't compensate for a bug in the host kernel itself.

The fix

The fix is a single upstream commit (6785011f8b16) from Red Hat's Michael S. Tsirkin. It adds a check, at five points in the networking code, that a packet's checksum metadata cannot point into the IPv4 header. The author calls it a defence-in-depth measure and notes that stricter validation of incoming packets is still to come. Expect follow-up patches.

First fixed versions per stable branch, according to the CVE record:

What to do

1. Patch the host, not just the guests. Move hypervisor and container hosts to a fixed kernel (or your distribution's build that contains the backport) and reboot into it. Updating a guest's kernel does nothing for the host.
2. Verify against your distribution's advisory, not uname -r alone. Distros often backport fixes without changing the upstream version number, so check the vendor changelog or security tracker for the running kernel.
3. Prioritise multi-tenant hosts. Start with anything that runs other people's code: CI/CD runners, sandbox and preview environments, shared VM or container platforms, and lab hosts.
4. Reduce blast radius while you wait. No dedicated workaround has been published. Keep host privileges tight: run VMMs under a jailer or equivalent least-privilege wrapper, disable nested virtualization where it isn't needed, and segment hosts.
5. Watch for follow-ups. The upstream fix is described as partial, so track your vendor's kernel advisories over the coming weeks.

Our take

This is a reminder that "each customer gets their own VM" is only as strong as the host kernel underneath it. It also adds to a growing list of real, chained kernel bugs found with AI-assisted research: pwn.ai says it found this one in three days for under $700 in model costs, with humans directing and validating the work. Defenders should assume the time from a bug being introduced to being found is shrinking, and patch hosts on that basis.

Originally reported by The Hacker News. Technical details are from the researcher's write-up, Vercel's challenge report and the CVE record.