PwnEscape Linux kernel flaw exposes host memory to guest VMs
A critical Linux kernel vulnerability tracked as CVE-2026-99999 and nicknamed PwnEscape allows code running inside a virtual machine to read memory from its host. The published CVE record assigns the flaw a 9.3 Critical score. Researcher Paulos Yibelo of pwn.ai demonstrated the memory disclosure against Vercel production sandboxes, and Vercel confirmed the finding.
The proof of concept used specially crafted network packets from a guest VM. Vercel said each outgoing packet could return about 32 bytes of host memory, with continued disclosure possible while packets continued to be sent. The finding concerns the isolation boundary that shared cloud platforms rely on to separate customer workloads from host systems.
A host kernel networking flaw, not a cloud configuration issue
PwnEscape is located in Linux networking code rather than in a configuration unique to Vercel. Vercel Sandbox runs customer code in Firecracker microVMs on bare-metal Amazon EC2 hosts. pwn.ai said it found no Vercel misconfiguration and described the sandbox as hardened beyond normal industry standards.
The researcher also achieved host crashes and code execution on systems under its control that were configured to match Vercel's environment. Two crafted packets were sufficient to crash a host and bring down its sandboxes in that testing. Yibelo stressed that this was a laboratory result, not a claim of root command execution in a vendor production environment.
Vercel said no challenge report demonstrated access to customer files, secrets or application data. The CVE attack vector is local: an attacker must already be able to execute code in a guest. There is no reported exploitation in the wild, and the issue is not listed in CISA's catalog of known exploited vulnerabilities.
For a broader view of Linux-focused threats and AI-assisted attack research, Linux rootkits and AI attack risks outlines related operational risks that security teams must keep under review.
Patch the host and verify the running build
The upstream fix is Linux commit 6785011f8b16, authored by Red Hat's Michael S. Tsirkin. It prevents a packet checksum-data pointer from referencing the IPv4 header before the kernel processes it, adding checks at five networking-code locations. The commit is described as a defence-in-depth measure; a fuller validation of packets as they enter the kernel still requires work.
The stable branches first fixed are 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 and 7.2.11. Distribution maintainers may backport the change without altering the visible upstream version, so operators should consult their vendor advisory and confirm that the host's running kernel contains the fix.
What infrastructure teams should do
Administrators should update the host kernel to a fixed version or a vendor build containing the patch, then reboot into that kernel. Updating only guest kernels does not remediate the vulnerable host-side code, and the published guidance provides no separate workaround for environments that cannot patch immediately.
Where patching is delayed, limiting the reach of a successful escape remains relevant. Vercel cited current host-kernel patching, disabled nested virtualization and Firecracker's jailer, which restricts the microVM process to the permissions it needs. The practical business implication is to treat host-kernel patch verification and reboot completion as an urgent shared-infrastructure control, while retaining containment measures until every affected host is remediated.