PwnEscape: Critical Linux Kernel Flaw Exposes Host Memory to Virtual Machines

A critical vulnerability in the Linux kernel could allow attackers running code inside a virtual machine to access memory belonging to its host. Tracked as CVE-2026-99999 and nicknamed PwnEscape, the flaw was discovered by security researcher Paulos Yibelo of pwn.ai during Vercel’s $1 million sandbox security challenge. Unlike vulnerabilities caused by cloud misconfigurations, this issue originates in the Linux kernel’s networking subsystem, potentially affecting other virtualization environments using vulnerable kernel versions.

How the Exploit Works

According to pwn.ai’s technical research, the vulnerability involves improper validation of network packet checksum metadata. By sending specially crafted packets from inside a virtual machine, an attacker can trigger unsafe memory operations in the host kernel. During testing against Vercel’s production sandboxes, the researcher demonstrated that each packet could leak approximately 32 bytes of host memory, with additional packets allowing further disclosure.

The researcher also demonstrated host crashes and privilege escalation in a controlled laboratory environment. Two crafted packets were enough to crash a host, potentially disrupting every sandbox running on it. Further testing achieved host-level administrative control, effectively escaping the virtual machine. However, these more severe outcomes were demonstrated only on the researcher’s own systems, not in Vercel’s production environment.

Why This Matters for Cloud Security

Vercel Sandbox uses Firecracker microVMs to isolate customer workloads on Amazon EC2 bare-metal infrastructure. These virtual machines are designed to prevent applications from accessing the underlying host or other customers’ environments. PwnEscape demonstrates how a vulnerability in host-side kernel processing can undermine those boundaries even when the virtualization environment is properly configured.

The vulnerability carries a reported CVSS score of 9.3 (Critical). Exploitation requires an attacker to already have code execution inside an affected guest environment, meaning it cannot simply be triggered remotely over the internet. Vercel confirmed the memory leak but reported no evidence of customer files, secrets, or application data being accessed.

Linux Kernel Fix and Mitigation

Linux maintainers addressed the vulnerability through commit 6785011f8b16, authored by Red Hat developer Michael S. Tsirkin. The patch introduces additional checks to prevent invalid checksum offsets from referencing the IPv4 header.

The reported first fixed versions are:

Kernel branch	Fixed version
5.10	5.10.272
5.15	5.15.223
6.1	6.1.190
6.6	6.6.159
6.12	6.12.113
6.18	6.18.57
7.2	7.2.11

Administrators should update their virtualization hosts and reboot into a patched kernel. Updating only the guest operating system will not resolve the host-side vulnerability. Since Linux distributions frequently backport security fixes, checking the vendor’s security advisory is more reliable than comparing kernel version numbers alone.

Discovered With AI-Assisted Security Research

Interestingly, pwn.ai reported discovering PwnEscape in approximately three days using its internal AI-assisted research platform, Omega-Pwn, with GPT-5.6 Sol supporting kernel source-code analysis. Human researchers directed the investigation and verified the findings through practical testing, with reported API costs below $700.

The discovery became the only Critical finding in Vercel’s security challenge, which awarded approximately $242,000 across 1,285 reports. Although there is currently no public evidence of exploitation in real-world attacks, PwnEscape highlights how a single kernel vulnerability can threaten isolation across shared cloud infrastructure.

References

• pwn.ai — PwnEscape Research
• Vercel — Sandbox Challenge Findings
• CVE-2026-99999
• Linux Kernel Security Patch