A critical flaw in the Linux kernel’s networking code, nicknamed PwnEscape and tracked as CVE-2026-99999, lets code running inside a virtual machine reach the computer that hosts it. Researcher Paulos Yibelo of pwn.ai found that specially made network packets sent from a guest could leak host memory, crash the host, and, in lab conditions, run code on it. The kernel’s CVE record rates it 9.3 out of 10, though the attack vector is local: the attacker must already be running code inside a guest. It is not listed as exploited in the wild and no real-world use has been reported, according to The Hacker News.
The bug was found in a two-week challenge Vercel ran in August that offered up to $1 million for a break-out of its Vercel Sandbox, which runs each customer’s code in a Firecracker microVM on EC2 hosts. Vercel confirmed the memory leak against its production sandboxes: each packet could carry back about 32 bytes of host memory. The crash and code-execution results were seen only on the researcher’s own machines, set up to match Vercel’s, and Vercel said no report showed anyone reading a customer’s files, secrets or application data. Because the flaw sits in the host kernel rather than in any one provider’s setup, Vercel said it is a risk to shared cloud infrastructure in general. pwn.ai said an AI-assisted research system found it in three days for under $700 in API tokens.
The fix is one kernel change, written by Red Hat’s Michael S. Tsirkin, that stops a packet’s checksum data from pointing into the IPv4 header before the kernel acts on it, applied at five places. Its author calls it “a defence in depth measure” and notes a fuller check at packet entry still needs work.
How to check if you’re affected
Affected products are Linux hosts that run guest virtual machines or microVMs, such as self-managed KVM or Firecracker servers, and cloud platforms that rely on them. A guest’s own kernel is not the thing to patch: updating only a guest does not fix the host.
- Check the host kernel version against the first fixed version in each stable branch from the CVE record: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 and 7.2.11. A host kernel older than the fixed version in its branch does not have the fix.
- Distributions often backport fixes without changing the version number, so check your distribution’s advisory and confirm the fix is in the kernel actually running, not only the number reported by
uname -r. Reboot into the patched kernel. - The sources give no separate workaround. Vercel said it keeps host kernels updated, disables nested virtualization and runs each microVM under Firecracker’s jailer, which narrows what an attacker could do but does not fix the flaw.
- If you buy sandboxes or VMs from a cloud provider, the provider patches the host; ask about their status rather than changing anything in your own guests.