Critical PwnEscape Flaw in Linux Kernel Lets Guest VMs Read Host Memory

A newly disclosed critical flaw in the Linux kernel lets code running inside a virtual machine read memory on the host computer. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and the company confirmed it.

The flaw is tracked as CVE-2026-99999 and nicknamed PwnEscape. It lives in the Linux kernel's networking code, not in any one cloud's configuration, so it reaches the shared layer that providers rely on to keep customer workloads apart. It was found in a Vercel security challenge and reported privately, with no sign of real-world abuse.

What the researcher showed

Paulos Yibelo of the security firm pwn.ai found that specially crafted network packets sent from inside a VM could do three things: read the host's memory, crash the host, and run code on it. All three stem from the same kernel defect.

Per Vercel, the memory leak was demonstrated against its production sandboxes. Each packet the guest sent out carried back about 32 bytes of host memory, and the guest could keep going as long as it kept sending. The crash and code execution were observed only on the researcher's own machines, configured to match Vercel: two packets were enough to bring down a host and every sandbox on it. Using the same flaw, he then reached administrator control of a host — though he stressed this was a lab result, not a claim of owning any vendor's production.

Vercel noted that no report in the challenge showed anyone reading another customer's files, secrets, or application data.

How severe it is

The kernel's maintainers rated the flaw 9.3 out of 10 — Critical. The attack vector is listed as local: the attacker must already be running code inside a guest. It cannot be exploited remotely by packets from the open internet, and it is not in CISA's catalog of actively exploited vulnerabilities.

Why it reaches beyond Vercel

Vercel Sandbox runs each customer's code in its own Firecracker microVM on bare-metal Amazon EC2 hosts. That microVM is the wall between customers and the host. The flaw is not in the wall — it is in the kernel networking code the host runs. pwn.ai said Vercel's sandbox was hardened beyond normal industry standards, with no misconfiguration it could find. Because nearly every large cloud separates workloads at the same kernel layer, the risk is to shared infrastructure as a whole.

The fix

The fix is a single kernel commit (6785011f8b16) by Red Hat's Michael S. Tsirkin, merged into mainline. It adds a check that a packet's checksum data cannot point into the IPv4 header, applied at five places in the networking code. The author calls it a "defence in depth measure" and notes a fuller check on packet entry still needs work. The fix has been backported to the stable branches.

You must update the host kernel and reboot into it — updating a guest's kernel fixes nothing. Distributions often add such fixes without bumping the version number, so check your distro's advisory rather than just uname.

Found in a $1 million challenge

The flaw surfaced in a two-week Vercel challenge in August offering up to $1 million in total. No single payout reached that figure: the top per-report reward was $50,000, and Vercel paid $242,000 across 1,285 reports — this was the sole Critical finding. pwn.ai says it found the bug in three days using its own AI-assisted system, with the model analyzing source code and humans directing the work, at a cost of under $700 in API tokens.

Source: The Hacker News