PwnEscape Linux kernel flaw lets VMs read host memory
The PwnEscape Linux kernel flaw allows code already running inside a virtual machine (VM), an isolated software-based computer, to read memory belonging to its physical host. Tracked as CVE-2026-99999, the vulnerability was found by security firm pwn.ai during a Vercel security challenge. Vercel confirmed that the researcher demonstrated the memory disclosure against its live cloud sandboxes. The issue was reported privately before publication, and no real-world exploitation has been reported.
PwnEscape is located in the Linux kernel's networking code rather than in a configuration unique to one cloud platform. The kernel is the central part of an operating system that manages hardware, memory and running programs. According to pwn.ai's technical account, specially constructed network packets sent from a guest VM could expose host memory, crash the host or allow code to run on it. Those outcomes all resulted from the same underlying kernel defect.
In the production demonstration, Vercel said each packet could return about 32 bytes of host memory to the guest. The process could continue as long as the guest kept transmitting packets. Vercel also said none of the challenge reports showed access to customer files, secrets or application data. That distinction matters because the test established an ability to cross an important isolation boundary, but it did not establish that customer information had been taken.
The more disruptive results were demonstrated only on systems controlled by the researcher and configured to match Vercel's environment. In those tests, two crafted packets could crash a host and stop every sandbox running on it. The researcher also used the vulnerability to escape the VM and obtain administrator control of the host. pwn.ai explicitly limited that claim to the laboratory work and did not claim administrator command execution in any vendor's production environment.
The published CVE record gives CVE-2026-99999 a severity score of 9.3 out of 10, classifying it as Critical. The U.S. National Vulnerability Database had received the record but had not completed its own review. The listed attack vector is local, meaning an attacker must first be able to run code inside a guest VM. It is not described as a vulnerability that an unauthenticated outsider can trigger merely by sending traffic over the public internet. The flaw was not listed in the Cybersecurity and Infrastructure Security Agency catalog of actively exploited vulnerabilities, and there were no reports of attacks using it.
Vercel Sandbox places customer code in separate Firecracker microVMs, which are small virtual machines, on bare-metal Amazon EC2 hosts. Each microVM has its own Linux kernel and provides a boundary between the customer workload, the host and other customers. PwnEscape affects networking code used by the host kernel, so the weakness sits beneath that guest boundary. pwn.ai reported finding no relevant misconfiguration and described the sandbox as already hardened beyond normal industry standards. Vercel said this type of kernel weakness can affect shared infrastructure because large cloud environments commonly rely on the Linux kernel layer to separate workloads.
The mainline Linux kernel fix is commit 6785011f8b16. The change checks that packet checksum information does not point into the IPv4 header before the kernel processes it, applying the validation at five locations in the networking code. The change was described by its author at Red Hat as a defence-in-depth measure rather than a complete solution. Work on a fuller check for the path through which packets enter the kernel was still needed.
Linux maintainers backported the change to supported stable branches. The CVE record identifies the first fixed releases as 5.10.272 for branch 5.10, 5.15.223 for 5.15, 6.1.190 for 6.1, 6.6.159 for 6.6, 6.12.113 for 6.12, 6.18.57 for 6.18 and 7.2.11 for 7.2. Linux distributions can add security corrections to their own kernel packages without adopting those exact version numbers. Administrators should therefore consult their distribution's advisory and verify that the running host kernel contains the fix instead of relying only on the version displayed by the uname command.
Remediation requires updating the host kernel to a fixed stable release or a distribution package containing the correction, followed by a reboot into that kernel. Updating only the guest VM does not repair the vulnerable host. No separate workaround was given for systems that cannot yet be updated. Where deployment must wait, limiting host permissions and the reach of individual workloads can reduce the potential consequences without correcting the underlying defect. Vercel said it keeps host kernels current, disables nested virtualization and uses Firecracker's jailer to restrict the permissions available to each microVM process.
The vulnerability emerged from a two-week challenge held in August, with up to $1 million available across all findings. No individual award reached that amount. The highest reward for one report was $50,000, and Vercel paid $242,000 across 1,285 reports. PwnEscape was the challenge's only Critical finding. pwn.ai said it identified the flaw in three days and spent under $700 on application programming interface tokens for its AI-assisted research system. The system used Omega-Pwn, elements of SingularityNET's OmegaClaw architecture and GPT-5.6 Sol for source-code analysis, while human researchers directed the investigation and checked results against Linux kernel behaviour on systems they controlled. The disclosure follows a separate case earlier in the year in which another team used a large language model to reach internal OpenAI systems.
For organisations reviewing their infrastructure after this disclosure, AEU Data offers European cloud and data infrastructure. Regardless of provider, website owners and businesses should obtain confirmation that the physical hosts supporting their virtual machines have received the kernel correction, since changes made only inside a hosted VM are insufficient.