PwnEscape: Critical Linux kernel flaw allows VMs to read host memory

A critical security vulnerability in the Linux kernel, tracked as CVE-2026-99999 and nicknamed PwnEscape, allows code running inside a virtual machine to read memory from the host system. Discovered by researcher Paulos Yibelo of pwn.ai during a Vercel security challenge in August 2026, the flaw was confirmed by Vercel after being demonstrated against its live cloud sandboxes. The issue resides in the shared Linux kernel networking layer, posing a risk to cloud providers that rely on this infrastructure for workload isolation.

What happened

Paulos Yibelo demonstrated that specially crafted network packets sent from within a guest virtual machine could trigger three distinct outcomes: reading host memory, crashing the host, and executing code on the host. In tests against Vercel’s production sandboxes, each packet leaked approximately 32 bytes of host memory, a process that could be repeated indefinitely by sending more packets. While the memory leak was verified in production, the crash and code execution capabilities were observed only in laboratory environments configured to mimic Vercel’s setup. Two specific packets were sufficient to crash a host and disrupt all sandboxes running on it, and further exploitation allowed the researcher to gain administrator control in these controlled tests.

The vulnerability was identified using Omega-Pwn, an internal research harness that combined security tooling with elements of SingularityNET's OmegaClaw architecture. GPT-5.6 Sol served as the primary reasoning engine, analyzing source code and tracing hypotheses under human direction. Yibelo emphasized that while administrator control was achieved in the lab, this was not a claim of root command execution in any vendor's production environment. Vercel reported that no participant in the challenge accessed customer files, secrets, or application data, and there is no evidence of real-world exploitation.

How it works

The flaw exists in the Linux kernel’s networking code, specifically in how it handles packet checksums. It is not a misconfiguration in any single cloud provider’s setup but a defect in the shared kernel layer used by most major clouds to isolate customer workloads. The exploit involves sending network packets where the checksum data points into the IPv4 header before the kernel processes it. This allows the guest VM to bypass isolation boundaries and access host memory.

The fix, implemented in commit 6785011f8b16 by Red Hat’s Michael S. Tsirkin, adds a check at five places in the networking code to ensure checksum data cannot point into the IPv4 header. The author describes this as a "defence in depth measure," noting that a more comprehensive check on packet entry is still pending. This patch has been backported to multiple stable kernel branches, addressing the immediate risk while longer-term improvements are developed.

Key details

• Vulnerability ID: CVE-2026-99999, nicknamed PwnEscape.
• Severity: Rated 9.3 out of 10 (Critical) by kernel maintainers.
• Attack Vector: Local; requires code execution inside a guest VM.
• Impact: Memory leak (32 bytes per packet), host crash, and potential code execution.
• Discovery: Found by pwn.ai in three days using AI-assisted research during a Vercel bug bounty challenge.
• Status: No active exploitation reported; fix merged into mainline and stable kernels.

Why it matters

For software engineers and technical leads, this vulnerability highlights the fragility of isolation in multi-tenant cloud environments. Since the flaw lies in the Linux kernel itself, it affects any service using Firecracker microVMs or similar virtualization technologies on bare-metal hosts. Even if your application code is secure, the underlying infrastructure may be vulnerable. This reinforces the need for defense-in-depth strategies, as relying solely on virtualization boundaries is insufficient when the host kernel is compromised.

The discovery method also signals a shift in security research. The use of large language models like GPT-5.6 Sol to analyze kernel code and chain vulnerabilities reduced the cost of finding this critical flaw to under $700 in API tokens. This suggests that AI-assisted fuzzing and analysis will become standard tools for both attackers and defenders, accelerating the pace at which deep system vulnerabilities are uncovered. Teams must now consider AI-driven threat modeling as part of their security posture.

What you can do

• Update your host kernel to a fixed version immediately; updating guest kernels alone does not resolve the issue.
• Verify your distribution’s advisory to ensure the fix (commit 6785011f8b16) is included, as version numbers may vary.
• Reboot systems after applying the kernel update to ensure the new kernel is active.
• If immediate patching is not possible, limit the impact by disabling nested virtualization and restricting permissions for microVM processes.
• Monitor for updates from your cloud provider regarding host kernel patches and maintenance windows.
• Review your own security testing pipelines to incorporate AI-assisted analysis tools for deeper code inspection.