Linux Kernel Flaw PwnEscape Lets Guest VMs Read Host Memory, Run Code

What the Researcher Demonstrated

A critical vulnerability in the Linux kernel's networking code allows specially crafted network packets sent from inside a virtual machine to read memory on the host computer it runs on. The flaw, tracked as CVE-2026-99999 and nicknamed PwnEscape, was discovered by Paulos Yibelo of the security firm pwn.ai. Each packet a guest sent out could carry back about 32 bytes of the host's memory. The same flaw also enabled a host crash and code execution on the host, though those two were confirmed only on the researcher's own machines configured to match Vercel's setup.

Vercel confirmed the memory leak was demonstrated against its production sandboxes. The company said no report in its challenge showed anyone reading a customer's files, secrets, or application data. Yibelo stated this was a lab result and not a claim of root command execution in any vendor's production environment.

How the Flaw Was Found

The discovery came through Omega-Pwn, an internal research harness that combines pwn.ai's own security tooling with elements of SingularityNET's OmegaClaw architecture. GPT-5.6 Sol served as the primary reasoning engine. Yibelo said the system let the team carry hypotheses, code traces, and experimental results across long-running sessions, while human researchers directed the investigation and validated findings against actual kernel behavior. The firm found the flaw in three days at a cost of under $700 in API tokens.

Vercel found the issue during a two-week sandbox escape challenge it ran in August, offering up to $1 million in total rewards. The company paid $242,000 across 1,285 reports. This was the single Critical finding. The top reward per report was $50,000.

The Fix and Affected Versions

Linux kernel maintainers rated the flaw 9.3 out of 10, or Critical. The attack vector is listed as local, meaning the attacker must already be running code inside a guest. The fix is a single kernel change, commit 6785011f8b16, written by Red Hat's Michael S. Tsirkin and merged into the mainline kernel. It adds a check that a packet's checksum data cannot point into the IPv4 header before the kernel acts on it, applying that check at five places in the networking code.

The fix was backported to stable branches, with first fixed versions including 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, and 7.2.11. Linux distributions often ship their own kernels and may include this fix without changing the version number, so administrators should check their distribution's advisory and confirm the fix is in the kernel the host is actually running. Updating only a guest's kernel does not fix the host.

Vercel said it keeps host kernels up to date, disables nested virtualization, and runs each microVM under Firecracker's jailer, which grants the microVM process only the permissions it needs. That does not fix the flaw, but it narrows what an attacker who used it could do.

Sources: The Hacker News