Linux kernel networking flaw enables VM escape; fix available
PwnEscape (CVE-2026-99999, per pwn.ai) is a flaw in the host-side Linux kernel networking stack, found by Paulos Yibelo (pwn.ai) during Vercel's $1 million challenge. Crafted packets sent from inside a microVM can leak host memory, crash the machine, and execute code with full privileges. The fix is in upstream commit 6785011f8b16 and stable backports; update kernels on hosts running KVM/Firecracker.
What happened
A Linux kernel flaw, named PwnEscape, lets a virtual machine break out of its isolation and attack the host server. Researcher Paulos Yibelo of pwn.ai found it during Vercel's $1 million bounty challenge, and Vercel confirms no report showed access to customer data. A fix has already shipped in the kernel.
Why it matters
Vercel states that almost every major cloud provider isolates customer workloads on this same kernel layer, so the defect is a shared-infrastructure risk. A malicious guest can read host memory, crash every sandbox on the machine, and run commands with full administrator privileges. This affects any company running KVM or Firecracker with third-party code in guests.
What to do
Update host kernels to the stable backport versions (5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, or 7.2.11, per your vendor). Review hosts that run untrusted guests and patch them first. Keep host and guest kernels up to date and reduce the kernel attack surface.
For the technical team
- CVE
- CVE-2026-99999
- Affected
- Linux Kernel Linux, rede no lado host (KVM/Firecracker e similares) · Kernels before stable backports 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, and 7.2.11 (verify vendor packages). Scenario: KVM/Firecracker hosts and similar.
- Exploitation
- No malicious exploitation reported. The pwn.ai write-up (2026-10-26) details the technique. Demonstrated attacks: host memory leak against Vercel production sandboxes; host crash and administrator-privilege code execution on the researcher's own KVM/Firecracker machines matching Vercel Sandbox configuration.
- Fix
- Upstream commit 6785011f8b16 and matching stable backports; vendor kernels as listed by distros.
- Vector
- Host-side Linux kernel networking stack. Specially crafted packets sent from inside the microVM (guest) trigger the flaw. No host login required; the guest only needs to send packets over the network.
- More details
- Three attacks from one defect: continuous host memory leak in outgoing guest packets, host crash with two packets (shuts down every sandbox on it), and code execution on the host. Found by Paulos Yibelo (pwn.ai) on day 3 of Vercel's challenge; 1,285 reports over two weeks, $242,000 in bounties, 1 critical finding. Vercel coordinated the fix with the researcher, AWS, and partners; no report showed anyone reading customer files, secrets, or application data. The challenge also uncovered a cross-tenant leak in the device-mapper storage layer (reading recycled disk blocks from deleted sandboxes), found by intern Marcos Hernanz, and a snapshot-restore trust flaw that required knowing the victim's internal 96-bit storage key.
Timeline
pwn.ai write-up and Vercel findings detail the sandbox escape.
