A Linux kernel flaw nicknamed PwnEscape allows code running inside a virtual machine to read memory from the host, crash the host and, under lab conditions, run code on it. The vulnerability is tracked as CVE-2026-99999 and carries a Critical rating of 9.3 in the CVE record, although the National Vulnerability Database review is not finished. The write-up and kernel fix were published October 15.
Crafted Packets Leak About 32 Bytes of Host Memory Each
Paulos Yibelo of pwn.ai found the flaw during a Vercel security challenge, using AI-assisted research tooling, and reported it privately. Specially crafted network packets sent from a guest each leaked about 32 bytes of host memory. The leak was demonstrated against Vercel’s production sandboxes, and Vercel confirmed it. The date of the private report was not stated, so the length of time between the report and the October 15 publication is unknown.
The CVE record rates the flaw 9.3, but the National Vulnerability Database has not completed its own review, so its independent assessment is still pending.
The bug sits in Linux kernel networking code, not in any single cloud provider’s software. That means it affects the shared isolation layer that most clouds rely on. Vercel Sandbox runs each customer in a Firecracker microVM on bare-metal EC2 hosts.
Two Packets Crashed a Host; Administrator Control Worked Only in the Lab
Yibelo showed that two crafted packets could crash a host, which takes down every sandbox running on it. He also reached administrator control of a host, but only on lab machines configured to match Vercel’s setup, not in Vercel’s production environment.
Local Attack Vector and No Reported Exploitation
The attack vector is local: an attacker must already be running code inside a guest. CVE-2026-99999 is not in CISA’s Known Exploited Vulnerabilities catalog, and no real-world exploitation has been reported. Vercel said no report showed access to customer files, secrets or application data.
For multi-tenant clouds and sandbox services, the local requirement matters less than it would elsewhere, because these platforms exist to run untrusted code from many customers on shared hosts. A guest that can read host memory could cross the boundary between tenants until host kernels are updated.
The Kernel Commit: A Checksum Check Applied in Five Places
The fix is kernel commit 6785011f8b16, written by Red Hat’s Michael S. Tsirkin. It adds a check that packet checksum data cannot point into the IPv4 header, and it applies the check in five places. Tsirkin describes the change as defence in depth and says a fuller check is still needed. The commit has been backported to stable branches.
Host Kernels Need the Update; Guest Kernels Do Not
Updating a guest kernel does not help. Operators need to update the host kernel to a fixed version or a vendor build and then reboot. Distributions may backport the fix without changing the version number, so version strings alone may not show whether a host is protected. No separate workaround exists.
Vercel said it keeps host kernels current and disables nested virtualization. Those two measures describe Vercel’s own configuration only; operators of other VM-backed services would need to check their own hosts.
Where PwnEscape Fits for Cloud Isolation
The finding adds to a long record of research targeting the boundary between guest and host. What distinguishes this case is that the vulnerable code is generic kernel networking logic rather than a hypervisor-specific component, and that the researcher used AI-assisted tooling to locate it. Tsirkin’s own statement that a fuller check is still required indicates the current patch may not be the last change in this area of the code.
Operators of Firecracker-based or other VM-backed services will be watching for whether additional fixes follow, and whether the NVD completes its review of the 9.3 rating.
