Linux Kernel Vulnerability PwnEscape Could Allow Virtual Machine Escape and Host Memory Exposure

A newly disclosed critical vulnerability in the Linux kernel's networking code could allow an attacker operating inside a virtual machine to access host memory, crash the host system, or potentially execute code on the host. Tracked as CVE-2026-99999 and nicknamed PwnEscape, the flaw was demonstrated against Vercel's production cloud sandboxes during a security research challenge.

The vulnerability affects the shared Linux kernel layer used to isolate workloads in cloud environments. While the researcher demonstrated host memory exposure against Vercel's live sandboxes, host crashes and code execution were demonstrated only on the researcher's own systems configured to resemble Vercel's environment.

Vercel confirmed the memory-leak findings. No evidence of real-world exploitation has been reported, and the company said the research did not demonstrate access to customer files, secrets, or application data.

How the PwnEscape Vulnerability Works

Paulos Yibelo of security firm pwn.ai discovered the vulnerability while participating in Vercel's sandbox security challenge.

According to the researcher's technical findings, specially crafted network packets sent from inside a virtual machine can trigger the Linux kernel flaw. The researcher demonstrated three potential consequences:

  • Host memory disclosure: Packets sent from a guest virtual machine could expose approximately 32 bytes of host memory per packet in Vercel's production sandbox environment.
  • Host system crash: Two specially crafted packets were sufficient to crash a host in the researcher's test environment, potentially affecting every sandbox running on that host.
  • Potential host code execution: The researcher achieved administrator-level control of a host in a controlled laboratory environment, demonstrating a virtual machine escape.

The researcher emphasized that the host crash and code-execution demonstrations were performed on personally controlled systems rather than in a vendor's production environment.

The vulnerability is particularly concerning because the same underlying kernel flaw can produce multiple security impacts, ranging from information disclosure to a complete breach of virtual machine isolation.

CVE-2026-99999: Severity and Exploitation Requirements

The vulnerability has been assigned CVE-2026-99999 and received a published CVSS score of 9.3 out of 10, classified as critical. At the time of disclosure, the National Vulnerability Database had received the record but had not completed its independent review.

The vulnerability is classified as a local attack vector. An attacker must already be able to execute code inside a guest virtual machine to attempt exploitation. It is not described as a vulnerability that an unauthenticated outsider can trigger simply by sending packets over the public internet.

As of the reported disclosure, the vulnerability had not been added to the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, and there were no reports of exploitation in real-world attacks.

Why Cloud Infrastructure Could Be Affected

Vercel Sandbox runs customer workloads in isolated Firecracker microVMs on bare-metal Amazon EC2 hosts. Each microVM has its own Linux kernel, providing a separation layer between customer workloads and the underlying host.

However, PwnEscape affects Linux kernel networking code, making the issue relevant to the underlying isolation architecture rather than a specific Vercel configuration.

The researcher reported that Vercel's sandbox environment was already hardened beyond typical industry standards and that no misconfiguration was identified as the cause of the vulnerability.

Because cloud providers commonly rely on operating-system and virtualization boundaries to isolate customer workloads, a vulnerability in the host kernel can have implications beyond a single hosting platform.

Vercel stated that the issue highlights the risks associated with vulnerabilities in shared infrastructure components used by cloud providers.

Linux Kernel Fix and Patched Versions

The fix is implemented in Linux kernel commit 6785011f8b16. Authored by Red Hat's Michael S. Tsirkin, the change adds checks to prevent packet checksum data from pointing into the IPv4 header before the kernel processes it. The checks are applied at five locations in the networking code.

The patch is described as a defense-in-depth measure, with additional work still needed to implement more comprehensive validation as packets enter the kernel.

According to the published CVE record, the first fixed versions across the listed stable branches are:

Linux kernel branchFirst fixed version5.105.10.2725.155.15.2236.16.1.1906.66.6.1596.126.12.1136.186.18.577.27.2.11

Linux distributions often backport security patches into their own kernel packages without changing the upstream version number. Administrators should therefore consult their distribution's security advisory and verify whether the fix is present in the kernel actually running on the host.

Organizations running virtual machines or cloud sandbox infrastructure should prioritize the following actions:

  1. Patch the host kernel: Upgrade to a listed fixed version or a vendor-provided kernel package containing the security fix.
  2. Reboot into the patched kernel: Confirm that the updated kernel is active after installation.
  3. Verify the host, not just the guest: Updating a virtual machine's own kernel does not remediate a vulnerable host kernel.
  4. Strengthen isolation controls: Where supported, disable nested virtualization and use appropriate sandboxing mechanisms to restrict the privileges available to virtual machine processes.
  5. Review cloud-provider advisories: Managed infrastructure customers should follow their provider's guidance on host-level remediation.

Vercel reported that it keeps host kernels updated, disables nested virtualization, and runs each microVM under the Firecracker jailer. These controls can reduce potential impact, but they do not eliminate the underlying vulnerability.

No separate workaround was identified in the reported disclosure for environments that cannot apply the kernel update.

Discovered During Vercel's $1 Million Security Challenge

PwnEscape was discovered during a two-week Vercel security challenge held in August 2026. The challenge offered up to $1 million in total rewards for researchers who could break out of the company's sandbox environment.

Vercel reported paying $242,000 across 1,285 submissions. The maximum individual reward was $50,000, and PwnEscape was identified as the challenge's critical finding.

According to pwn.ai, its researchers identified the vulnerability in three days using an AI-assisted research system. The model helped analyze source code, while human researchers directed the investigation and validated the findings against actual kernel behavior on controlled systems. The firm estimated that its API-token costs were below $700.

The discovery adds to growing interest in using AI-assisted security research to identify vulnerabilities and connect multiple weaknesses into practical attack paths.

Security Implications

PwnEscape illustrates how a flaw in a shared operating-system component can undermine virtual machine isolation, even when the surrounding cloud environment has strong security controls.

Although there is no reported evidence of exploitation in the wild, the combination of host memory disclosure, system crashes, and laboratory-demonstrated host code execution makes remediation a priority for organizations operating affected Linux hosts.

Cloud providers and infrastructure teams should verify patch status, confirm that fixes are active on host systems, and continue reviewing the isolation controls protecting workloads from one another.