Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory
A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on.
A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on.
The flaw, now tracked as CVE-2026-99999 and nicknamed PwnEscape , is in the Linux kernel's networking code, not in any one cloud's setup, so it reaches the shared layer that cloud providers use to keep customers' workloads apart.
A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it.
It was found in a Vercel security challenge and reported privately before any public release, and there is no sign it has been used in a real attack.
Update the host kernel to one of the fixed versions above, or to the vendor build that includes the fix, and reboot into it.
Vercel Sandbox runs each customer's code in its own Firecracker microVM, a small virtual machine with its own copy of the Linux kernel, on bare-metal Amazon EC2 hosts.
Paulos Yibelo of the security firm pwn.ai found that specially made network packets sent from inside a virtual machine could do three things, he explained in a technical write-up : read the host's memory, crash the host, and run code on it.
Each packet the guest sent out could carry back about 32 bytes of the host's memory, and the guest could keep going as long as it kept sending packets.
The crash and code execution were observed only on the researcher's own machines, which were set up to match Vercel's.
The kernel's maintainers assigned the flaw CVE-2026-99999 and, in the published record, rated it 9.3 out of 10, or Critical.
What happened
A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on.
The flaw, now tracked as CVE-2026-99999 and nicknamed PwnEscape , is in the Linux kernel's networking code, not in any one cloud's setup, so it reaches the shared layer that cloud providers use to keep customers' workloads apart.
What changed
A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it.
It was found in a Vercel security challenge and reported privately before any public release, and there is no sign it has been used in a real attack.
Who is affected
Update the host kernel to one of the fixed versions above, or to the vendor build that includes the fix, and reboot into it.
Vercel Sandbox runs each customer's code in its own Firecracker microVM, a small virtual machine with its own copy of the Linux kernel, on bare-metal Amazon EC2 hosts.
Why it matters
Paulos Yibelo of the security firm pwn.ai found that specially made network packets sent from inside a virtual machine could do three things, he explained in a technical write-up : read the host's memory, crash the host, and run code on it.
Each packet the guest sent out could carry back about 32 bytes of the host's memory, and the guest could keep going as long as it kept sending packets.
Technical details
The crash and code execution were observed only on the researcher's own machines, which were set up to match Vercel's.
The kernel's maintainers assigned the flaw CVE-2026-99999 and, in the published record, rated it 9.3 out of 10, or Critical.
According to the CVE record, these are the first fixed versions in each supported branch: Linux distributions ship their own kernels and often add this kind of fix without changing the version number, so check your distribution's advisory and whether the fix is in the kernel the host is actually running, not only the number from uname.
Response
It adds a check that a packet's checksum data cannot point into the IPv4 header before the kernel acts on it, and applies that check at five places in the networking code.
The sources give no separate workaround for this flaw if you cannot update yet.
Attribution
The Hacker News: A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on.
What to watch next
Watch for updated vendor guidance and fixed-version details.