PwnEscape Linux kernel flaw lets guest VMs leak host memory

A critical vulnerability in the Linux kernel's networking code, dubbed PwnEscape and tracked as CVE-2026-99999, allows code running inside a guest virtual machine to read memory from the host that runs it, The Hacker News reported on October 15. Because most large cloud platforms separate customer workloads at the same kernel layer, the flaw is relevant to any provider or company running untrusted code in VMs on Linux hosts. Fixed stable kernels are already available.

What happened

According to The Hacker News, the flaw was found by Paulos Yibelo of security firm pwn.ai during a two-week Vercel security challenge in August and reported privately before public release. The published CVE record rates it 9.3 out of 10, though the U.S. National Vulnerability Database had not completed its review. Vercel paid $242,000 across 1,285 reports in the challenge, and PwnEscape was the only critical finding. pwn.ai said it found the bug in three days using an AI-assisted research system directed by humans.

The report says there is no sign the flaw has been used in real attacks, and it is not listed in CISA's Known Exploited Vulnerabilities catalog.

Technical details

The attack vector is local: an attacker must already run code inside a guest VM. Specially crafted network packets sent from the guest can read host memory, crash the host and potentially run code on it. Vercel confirmed the memory leak against its production sandboxes, which run customer code in Firecracker microVMs on bare-metal Amazon EC2 hosts. Each outbound packet could carry back about 32 bytes of host memory, and the leak could continue as long as packets were sent, according to the outlet.

Crashes and code execution were observed only on the researcher's lab machines configured to match Vercel's. There, two crafted packets were enough to crash a host and every sandbox on it, and the researcher reached administrator control and broke out of the VM. He stressed this was a lab result, not a claim about any vendor's production environment. Vercel said no report showed anyone reading customer files, secrets or application data.

The fix, commit 6785011f8b16 by Red Hat's Michael S. Tsirkin, checks that a packet's checksum data cannot point into the IPv4 header at five places in the networking code. Its author describes it as a partial, defence-in-depth fix and says a fuller check on packet entry still needs work.

What to do

• Update host kernels to a fixed stable release: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 or 7.2.11, or a vendor build that includes the fix, then reboot.
• Updating only the guest kernel does not protect the host.
• Distributions may backport the fix without changing the version number, so check vendor advisories and confirm the running kernel includes it.
• The Hacker News cites no workaround. Vercel said it keeps host kernels current, disables nested virtualization and runs each microVM under Firecracker's jailer, measures that narrow but do not remove the risk.