A Linux kernel bug lets a virtual machine read its host’s memory. Patch the hosts, not just the guests

A Linux kernel bug disclosed this week lets code running inside a virtual machine read memory on the host it runs on. A researcher proved the leak against Vercel’s live cloud sandboxes, and in his own lab turned it into a full escape to the host.

Nobody is known to be using it. The fix is in the host kernel, so updating the guests does nothing.

The bug is not in the hypervisor. It is in the host’s Linux networking code, and every packet the guest sends can carry 32 bytes of host memory back.
The 5-Minute Cyber Brief
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
Email address
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.

PwnEscape lets a guest VM read host memory

The flaw, CVE-2026-99999, nicknamed PwnEscape, was found by Paulos Yibelo of pwn.ai during Vercel’s $1 million sandbox challenge in August. Specially crafted packets sent from inside a guest abuse checksum handling in the host’s IPv4 networking code. In Vercel’s production sandboxes each packet leaked about 32 bytes of host memory. On researcher-owned machines, two packets crashed a host, and a longer chain reached root on the host.

Vercel said no report in the challenge showed anyone reading customer files, secrets or application data. The kernel’s CVE record rates the bug 9.3 with a local attack vector: the attacker must already run code in a guest.

KVM and Firecracker hosts with untrusted guests

This matters for anyone who runs other people’s code in VMs: cloud and hosting providers, CI runners, AI agent sandboxes and internal multi-tenant KVM clusters. Vercel runs each sandbox in a Firecracker microVM on bare-metal EC2 hosts, and pwn.ai found no misconfiguration there; the weak point was the host kernel.

pwn.ai wrote that it expects working exploits for weaker configurations within weeks. The upstream fix, commit 6785011f8b16, is described by its author as a partial, defense-in-depth change, so watch for follow-up patches.

Update host kernels and reboot into them

Update host kernels to a fixed stable release: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 or 7.2.11, or your distribution’s build that carries commit 6785011f8b16.
Reboot into the new kernel and confirm the running kernel, not just the installed package, has the fix. Distributions often backport without changing the version number.
Start with hosts that run untrusted or customer workloads, then CI and build runners.
Until hosts are patched, disable nested virtualization where you do not need it and run microVMs under a jailer with minimal permissions, as Vercel does.

Forward this

For our platform or virtualization team: a Linux kernel bug lets code inside a VM read host memory, and a researcher showed a full host escape in a lab. It is not exploited yet. Can we patch and reboot the host kernels that run untrusted or customer workloads first?

Details

CVE-2026-99999 (PwnEscape): IPv4 checksum-start validation flaw in the Linux networking stack, CVSS 9.3 from the kernel CNA, local attack vector. Not in CISA KEV; no known attacks.
Fix: upstream commit 6785011f8b16, “ipv4: validate checksum_start before completing checksum,” by Michael S. Tsirkin; merged into mainline October 14, 2026.
First fixed stable versions: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, 7.2.11.
Vercel challenge: $242,000 paid across 1,285 reports; PwnEscape was the only Critical finding.

Hunt / verify

Unexpected host crashes or kernel oopses mentioning ip_do_fragment or skb_checksum_help on virtualization hosts.
Your distribution’s security tracker for CVE-2026-99999 to confirm which kernel package carries the fix.
An inventory of hosts with nested virtualization enabled, which widens what a guest can reach.

Source: pwn.ai: PwnEscape write-up; Vercel: findings from the sandbox challenge

Sources

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].