A critical flaw in the **Linux kernel** has been disclosed, enabling code within a virtual machine (VM) to read memory on its host computer. This vulnerability, tracked as **CVE-2026-99999** and nicknamed **PwnEscape**, resides in the kernel's networking code, making it a widespread concern for cloud providers that use the **Linux kernel** for customer workload separation. The flaw was initially discovered and reported privately during a security challenge hosted by **Vercel**, a cloud platform. There is currently no evidence of its exploitation in real-world attacks. ### What the Researcher Demonstrated **Paulos Yibelo** of the security firm **pwn.ai** detailed in a [technical write-up](https://pwn.ai/blog/pwnescape) that specially crafted network packets sent from inside a VM could achieve three objectives: read host memory, crash the host, and execute code on it. All three capabilities stem from the same underlying kernel flaw. **Vercel** confirmed in its [challenge report](https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge) that the memory leak was successfully demonstrated against its production sandboxes. Each malicious packet could exfiltrate approximately 32 bytes of host memory, allowing continuous data retrieval. While the crash and code execution were observed on the researcher's controlled machines, configured to mirror **Vercel**'s environment, these findings are significant. Just two specially crafted packets were sufficient to crash a host, consequently taking down all sandboxes running on it. **Yibelo** further achieved administrator control of a host through the same flaw, effectively breaking out of the virtual machine. He emphasized that this was a laboratory result and not a claim of root command execution in a vendor's production environment. "Our research ran through **Omega-Pwn**, an internal harness combining our own security research tooling with elements of [**SingularityNET**'s **OmegaClaw** architecture](https://github.com/asi-alliance/OmegaClaw-Core). It let us carry hypotheses, code traces, failed attempts, and experimental results across long-running research sessions. **GPT-5.6 Sol** was the primary reasoning engine. We directed the investigation, challenged its findings, and validated the interesting ones against actual kernel behavior on systems we controlled," **Paulos Yibelo** told The Hacker News. **Vercel** stated that no reports in the challenge demonstrated access to customer files, secrets, or application data. ### Severity and Attack Vector The **Linux kernel** maintainers have assigned **CVE-2026-99999** a critical severity rating of 9.3 out of 10. The **U.S. National Vulnerability Database (NVD)** has received this entry, with its own review pending. The attack vector is classified as local, meaning an attacker must already be running code inside a guest VM to exploit the flaw. This is not a vulnerability exploitable from the open internet. The flaw is not currently listed in **CISA**'s catalog of actively exploited vulnerabilities, and no real-world exploitation has been reported. ### Broader Implications Beyond Vercel **Vercel Sandbox** isolates customer code within **Firecracker microVMs**, each with its own **Linux kernel**, running on bare-metal **Amazon EC2** hosts. The **microVM** acts as the isolation boundary between customers and the host, and between different customers. Crucially, the flaw is not within this isolation boundary but in the **Linux kernel**'s networking code, which the host itself runs. **pwn.ai** noted that **Vercel**'s sandbox was already hardened beyond typical industry standards, with no misconfiguration found. Since most large cloud providers rely on the same **Linux kernel** layer for workload separation, this vulnerability poses a risk to shared cloud infrastructure rather than being specific to any single provider. ### The Fix and Affected Versions The fix for **PwnEscape** is a single **Linux kernel** change, [commit `6785011f8b16`](https://github.com/torvalds/linux/commit/6785011f8b16abf40b1e9d8b2e332232b3e68822), authored by **Red Hat**'s **Michael S. Tsirkin** and merged into the mainline kernel. This commit adds a check to prevent a packet's checksum data from pointing into the **IPv4** header before the kernel processes it, applying this check at five points in the networking code. The author describes the change as a "defense in depth measure," noting that a more comprehensive check on how packets enter the kernel is still under development. Maintainers have backported the fix to stable kernel branches. According to the **CVE** record, the first fixed versions in each supported branch are: | Stable branch | First fixed version | | :------------ | :------------------ | | 5.10 | 5.10.272 | | 5.15 | 5.15.223 | | 6.1 | 6.1.190 | | 6.6 | 6.6.159 | | 6.12 | 6.12.113 | | 6.18 | 6.18.57 | | 7.2 | 7.2.11 | **Linux** distributions often include such fixes without changing the primary version number. Users should consult their distribution's advisories and verify the actual kernel running on the host, not just the `uname` output. ### Recommended Actions Organizations should update their host kernels to one of the fixed versions listed above, or to a vendor-provided build that includes the patch, and then reboot. Updating only a guest's kernel will not remediate the host vulnerability. No separate workaround for this flaw has been provided for situations where immediate patching is not possible. Where patching is delayed, it is crucial to limit the potential reach of a breach. **Vercel**, for example, maintains up-to-date host kernels, disables nested virtualization, and runs each **microVM** under **Firecracker**'s jailer, which grants the **microVM** process only necessary permissions. While these measures do not fix the flaw, they significantly narrow what an attacker could achieve if they exploited it. ### Discovered in a $1 Million Challenge This critical flaw was uncovered during a two-week challenge hosted by **Vercel** in August, which offered up to $1 million in total rewards for sandbox escapes. While no single payout reached the maximum, **Vercel** distributed $242,000 across 1,285 reports, with **PwnEscape** being the sole critical finding. **pwn.ai** reported finding the flaw in three days using its **AI**-assisted research system, with the **AI** model conducting source-code analysis under human direction. The firm estimated the cost at under $700 in **API** tokens. This marks another instance of large language models (LLMs) aiding in the discovery and chaining of significant vulnerabilities, following a separate team's use of an LLM to breach internal systems at **OpenAI** earlier this year.