A flaw in the Linux kernel’s networking code can allow software inside a virtual machine to read memory from the physical server, or host, that runs it. Tracked as CVE-2026-99999 and nicknamed PwnEscape, it was found during Vercel’s $1 million sandbox challenge and demonstrated against Vercel’s production sandboxes. Fixed kernels for all seven maintained stable and long-term lines were released on October 15.
According to Vercel, almost every major cloud provider isolates customer workloads on this same layer of the Linux kernel, so a defect there is a risk for shared infrastructure. For hosting companies that sell virtual servers on KVM, the fix belongs in the host kernel, not inside customers’ machines.
Key facts
- Host takeover: crashing a host and running commands on it as administrator were shown only on the researchers’ own KVM and Firecracker machines.
- Score and range: the CVE record rates the flaw 9.3 under CVSS 3.1, and it affects kernels going back to version 2.6.27.
- The fix: a new check in five checksum paths, which the kernel commit calls a defense-in-depth measure, with broader input validation still to come.
- Researchers’ forecast: pwn.ai expects exploits for weaker configurations within weeks, and for default hypervisor configurations in under a month.
How a Checksum Instruction Became a Memory Leak
Linux can postpone calculating a packet’s checksum and store instructions for where to write it later. Paulos Yibelo of pwn.ai, a company offering autonomous penetration testing, found that a guest machine could supply such instructions with malformed values. In the path the researchers documented, the delayed write changed the IPv4 header length field from 20 bytes to 60 after the host had already checked the header. When the host then split the packet into fragments, it copied 32 bytes of host memory from beyond the packet’s data into the header of the outgoing packet.
According to Vercel, the leak can run continuously for as long as the guest keeps sending. On its production sandboxes, memory from a host shared with other tenants showed up in packets the guest sent over the internet.
The researchers demonstrated the host crash and code execution on their own machines. According to Vercel, on KVM and Firecracker machines matching Vercel’s configuration, two packets were enough to crash a host and shut down every sandbox on it, and the researcher ran commands on the host with full administrator privileges. The researchers stress that this is not a claim of code execution in any vendor’s production environment. In the challenge, no report showed anyone reading a customer’s files, secrets or application data.
From the Vercel Challenge to the CVE
Vercel opened the challenge on August 18. The researchers submitted their first host-memory report on August 20 and reported the root cause to the kernel’s security contact and networking maintainers on September 4, with candidate patches. Michael S. Tsirkin of Red Hat reproduced the issue three days later. The patch was discussed publicly on the netdev mailing list from September 19, and a revised version was applied to the networking tree on October 8. The CVE record and the fixed stable kernels followed on October 15.
According to Vercel, the challenge drew 1,285 reports in two weeks and paid out $242,000 in bounties, and PwnEscape was its only critical finding.
Fixed Kernels and the Validation Still to Come
The fix is in kernels 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 and 7.2.11. Written by Tsirkin, the patch adds a check before the kernel completes a pending checksum in five places across its IPv4, bridge, netfilter and IPsec code. The commit message calls it a defense-in-depth measure and states that a more complete validation at input is forthcoming but needs more work.
The researchers present their documented path as an example, not a claim that every network configuration takes it, and report finding numerous other ways to reach the vulnerable code.
Distribution kernels follow on their own schedules. On October 16, Debian’s security tracker marked the kernels in Debian 12 and 13 as vulnerable and listed a fix only for its unstable branch, in version 7.2.11. For hosting providers, the check is whether each host runs a kernel with the fix, either one of the upstream releases above or a distribution kernel that its vendor marks as fixed.
Vercel also lists the measures it uses to limit the damage if an attacker exploits the virtualization software: host kernels kept up to date, nested virtualization disabled, and Firecracker’s jailer, which runs each microVM process with restricted permissions.
The researchers plan a follow-up report detailing how they turned the memory leak into host control. They expect exploits for weaker configurations to appear within weeks, and exploits that work in default hypervisor configurations in under a month.
