Critical Linux Kernel ‘PwnEscape’ Flaw Exposes Cloud Hosts to Virtual Machine Attacks

A newly disclosed and critical vulnerability in the Linux kernel has sent ripples through the cloud computing industry, allowing malicious code executed within a virtual machine to read memory on the underlying host machine. Tracked as CVE-2026-99999 and colloquially dubbed "PwnEscape," the security loophole resides deep within the networking subsystem of the Linux kernel itself rather than in the configuration of any specific cloud platform. Because it impacts the foundational layer that cloud providers rely on to isolate different customer workloads, the flaw represents a systemic risk to shared infrastructure across the tech landscape.

The vulnerability was brought to light following a rigorous security challenge hosted by cloud platform provider Vercel, where researchers successfully demonstrated the exploit against live production cloud sandboxes. Security firm pwn.ai, led by researcher Paulos Yibelo, discovered the critical bug during the event and responsibly reported it through private channels ahead of any public disclosure. At the time of the announcement, security telemetry and vendor reports indicate that there is no evidence of the vulnerability being exploited in the wild by malicious actors.

What the Researcher Showed

In a detailed technical write-up, Paulos Yibelo outlined how specially crafted network packets transmitted from the interior of a guest virtual machine could achieve three distinct and dangerous outcomes: reading the host computer’s memory, crashing the host entirely, and executing arbitrary code. Strikingly, all three severe behaviors stem from the exploitation of a single underlying flaw in the Linux kernel.

During demonstrations conducted against Vercel’s production sandboxes—which were monitored and confirmed by the company—each network packet sent outward from the guest virtual machine carried back roughly 32 bytes of sensitive memory belonging to the host system. By continuously transmitting these packets, the guest environment could persistently harvest data from the host.

While memory leakage was successfully tested against Vercel’s live infrastructure, the more destructive capabilities—such as crashing the host and achieving code execution—were observed exclusively within isolated lab environments meticulously configured to mirror Vercel’s deployment architecture. According to the research team, firing merely two specially crafted network packets was enough to completely crash a host machine, instantly terminating every sandbox running concurrently upon it.

Leveraging the same kernel vulnerability, the researcher ultimately achieved administrator-level control of a host system, successfully orchestrating a virtual machine escape. However, the research team explicitly emphasized that this complete host takeover was strictly a controlled lab achievement and not a demonstration of root command execution within any commercial vendor’s live production environment.

The discovery process itself leveraged advanced automation and artificial intelligence. Yibelo detailed that the investigation ran through an internal harness designated as Omega-Pwn, which integrated specialized security research tooling with elements of the OmegaClaw architecture. Acting as the primary reasoning engine, an advanced AI model helped parse source code, track execution paths, and formulate hypotheses across long research sessions, while human experts directed the investigation, challenged findings, and validated kernel behaviors on physical systems.

Vercel corroborated the findings in its own post-challenge report, noting that while the memory leak was successfully demonstrated against its production sandboxes, no test report showed any evidence of an attacker successfully reading customer files, security secrets, or proprietary application data.

How Severe It Is, and Who Can Set It Off

Kernel maintainers formally cataloged the security issue as CVE-2026-99999, assigning it a base severity score of 9.3 out of 10, categorizing it firmly as a critical vulnerability. The entry was subsequently submitted to the U.S. National Vulnerability Database, where it awaited final formal review.

According to the official vulnerability records, the attack vector is classified as local. In practical terms, this means an adversary cannot exploit the vulnerability remotely across the open internet. Instead, an attacker must already possess the capability to execute code inside a guest virtual machine—such as through a compromised container or a low-privileged application workload—before they can initiate the packet crafting necessary to trigger the flaw. Furthermore, the vulnerability is not currently listed in the Cybersecurity and Infrastructure Security Agency catalog of known exploited vulnerabilities, reinforcing that real-world exploitation has not been observed.

Why It Reaches Beyond Vercel

The discovery unfolded within the architecture of Vercel Sandbox, a service that isolates each customer’s code inside dedicated Firecracker microVMs. These microvms operate as lightweight virtual machines equipped with their own individual instances of the Linux kernel, running atop bare-metal Amazon EC2 hosts. Ideally, this microVM layer acts as an impenetrable barrier separating individual customers from the underlying hardware host, as well as separating different customers from one another.

However, because the vulnerability exists inside the core networking code of the Linux kernel executed by the host rather than within the microVM boundary itself, the risk profile expands dramatically. Vercel noted that its sandboxes were already hardened significantly beyond standard industry baselines, presenting no structural misconfigurations that the security researchers could exploit. Because almost every major cloud service provider relies on similar layers of the Linux kernel to partition and isolate customer workloads, a flaw at this foundational level introduces a shared risk that affects the broader cloud ecosystem rather than pointing to a localized failure by any single provider.

The Fix and the Fixed Versions

Addressing the vulnerability required a targeted modification to the Linux kernel codebase. Authored by Michael S. Tsirkin of Red Hat and merged into the mainline kernel repository, the fix is formally tracked as commit 6785011f8b16abf40b1e9d8b2e332232b3e68822. The patch introduces a crucial validation check ensuring that packet checksum data cannot inappropriately point into the IPv4 header before the kernel attempts to process the packet, enforcing this check across five distinct locations within the networking subsystem.

The patch author characterized the update as a defense-in-depth measure, noting that more comprehensive validation regarding how incoming packets enter the kernel requires ongoing architectural improvements. Kernel maintainers promptly backported the security fix to all supported stable branches. The initial patched versions released across these branches include version 5.10.272 for the 5.10 branch, 5.15.223 for the 5.15 branch, 6.1.190 for the 6.1 branch, 6.6.159 for the 6.6 branch, 6.12.113 for the 6.12 branch, 6.18.57 for the 6.18 branch, and version 7.2.11 for the 7.2 branch.

Enterprise Linux distributions frequently maintain their own kernel packages and often backport critical security patches independently without altering the public version numbers visible in standard system commands. Consequently, administrators are advised to consult their respective distribution vendors’ security advisories to confirm whether the specific patch has been integrated into the running host kernel.

What to Do

Mitigating the risk of PwnEscape requires cloud operators and system administrators to update the host kernel to one of the officially patched versions, or to apply the corresponding vendor-supplied security update, followed by a full system reboot. Security experts emphasize that patching only the guest virtual machine kernels is insufficient, as the vulnerability resides on the host side. No alternative configuration-based workaround has been identified for systems unable to update immediately.

In environments where patching must be scheduled for a later maintenance window, standard defense-in-depth practices are recommended to minimize potential damage. Vercel stated that its operational security posture includes keeping host kernels strictly up to date, disabling nested virtualization capabilities, and executing each microVM under Firecracker’s strict jailer mechanism. This confinement layer restricts the microVM process exclusively to the minimum operating system privileges required for execution. While such isolation measures do not patch the underlying kernel bug, they significantly curtail the actions an attacker could take if the vulnerability were successfully triggered.

Found in a $1 Million Challenge

The vulnerability was uncovered during a high-stakes, two-week security challenge conducted by Vercel in August, which offered up to $1 million in total bounty rewards to researchers capable of successfully breaking out of its sandbox environment. While no single submission claimed the maximum grand prize, Vercel distributed a total of $242,000 across 1,285 submitted security reports, with the PwnEscape discovery standing out as the sole critical finding of the event.

The security team at pwn.ai reported that utilizing their AI-assisted research architecture allowed them to isolate the flaw in a remarkably short timeframe of just three days, with the automated reasoning engine handling complex source-code analysis while human researchers guided the strategic direction of the investigation. The firm estimated the operational cost of the AI API tokens utilized during the discovery process to be under $700. This milestone marks another prominent instance of security researchers successfully employing large language models to identify and chain complex software vulnerabilities, following a separate high-profile incident earlier in the year involving the discovery of internal system access at OpenAI.