PwnEscape Linux Kernel Flaw Allows Guest VMs to Read Host Memory

A critical vulnerability discovered in the Linux kernel, dubbed PwnEscape and identified as CVE-2026-99999, enables code running within a virtual machine (VM) to access and read memory from the host system it resides on. This significant flaw was demonstrated by a security researcher against Vercel's cloud sandboxes, a demonstration that Vercel has since confirmed.

The vulnerability is rooted in the Linux kernel's networking code, meaning it is not specific to any single cloud provider's configuration but rather affects the fundamental layer used by cloud services to isolate customer workloads. This widespread applicability raises concerns for various cloud environments that rely on the Linux kernel for their infrastructure.

Paulos Yibelo of pwn.ai, the researcher who uncovered the flaw, detailed in a technical write-up that specially crafted network packets sent from a guest VM could achieve three malicious actions: reading host memory, crashing the host system, and executing code on the host. All these capabilities stem from the same underlying kernel defect.

Vercel's own report on the security challenge indicated that the memory leak was successfully demonstrated against their production sandboxes. Each malicious packet sent from the guest VM could return approximately 32 bytes of host memory, and this process could be repeated to exfiltrate more data. While the memory leak was confirmed, the crash and code execution aspects were observed only on the researcher's controlled test systems, which were configured to mirror Vercel's environment.

Despite the potential for severe impact, the vulnerability has not been observed in any real-world attacks. It is not currently listed on CISA's catalog of actively exploited vulnerabilities. The attack vector is classified as local, meaning an attacker must already have code execution within a guest VM to exploit it, rather than being able to trigger it remotely over the internet.

The fix for PwnEscape involves a single change to the Linux kernel, commit 6785011f8b16, which adds a check to prevent packet checksum data from pointing into the IPv4 header. This change has been merged into the mainline kernel and backported to stable branches, with specific fixed versions listed for branches 5.10 through 7.2. Linux distributions are expected to incorporate this fix into their kernel builds.

Users are advised to update their host kernels to one of the patched versions or a vendor build that includes the fix and then reboot the host system. Updating only the guest VM's kernel will not resolve the underlying host vulnerability. No workarounds are available if immediate patching is not possible, though limiting the potential impact of a compromise through standard security practices like microVM isolation and restricted permissions remains advisable.

The PwnEscape vulnerability was discovered during Vercel's August security challenge, which offered up to $1 million for participants who could break out of its sandboxes. While the challenge successfully identified this critical flaw, Vercel stated that no reports indicated any participant accessed customer files, secrets, or application data.