A critical security vulnerability in the Linux kernel could allow attackers operating inside virtual machines to extract sensitive information from the underlying host system, potentially undermining the isolation protections used by cloud computing platforms.
The flaw, tracked as CVE-2026-99999 and dubbed PwnEscape, affects the Linux networking stack and carries a critical CVSS severity score of 9.3 out of 10, according to an official Linux kernel security advisory.
Security researcher Paulos Yibelo of pwn.ai discovered the vulnerability during a $1 million security challenge organized by cloud development platform Vercel in August 2026. The findings were subsequently confirmed by Vercel and coordinated with Linux kernel maintainers.
In its security disclosure, Vercel confirmed that specially crafted network packets originating from a guest virtual machine could expose host memory, crash the underlying server or enable code execution with elevated privileges.
Crucially, the researchers demonstrated continuous host-memory disclosure against Vercel’s production sandbox infrastructure. However, the more severe host-crashing and remote-code-execution capabilities were demonstrated only in controlled environments configured to replicate Vercel’s systems.
Vercel stated that none of the submitted vulnerability reports demonstrated unauthorized access to customer files, credentials or application data.
How PwnEscape Breaks Virtual Machine Isolation
According to technical research published by pwn.ai, the vulnerability stems from improper handling of network packet checksum metadata within the Linux kernel.
Under certain conditions, attacker-controlled checksum information can modify an IPv4 packet header after the kernel has already validated it. Subsequent packet-processing operations then rely on the altered information, potentially causing the kernel to read beyond the packet’s legitimate data boundaries.
Researchers demonstrated that this behavior could expose approximately 32 bytes of host memory per successful packet operation. By repeatedly generating specially constructed packets, an attacker could continue collecting information from the host.
In laboratory testing, the researchers extended the vulnerability into a broader exploit chain that allowed controlled writes to host kernel memory and execution of commands with root privileges.
The implications extend beyond Vercel because the affected functionality resides in the Linux kernel rather than a proprietary component of its cloud infrastructure.
Many cloud services rely on virtualization to isolate workloads belonging to different customers. A vulnerability that crosses this boundary could potentially expose information or disrupt services sharing the same physical infrastructure.
Nevertheless, exploitation requires an attacker to have the ability to execute code within a guest environment. The vulnerability is not directly exploitable simply by sending malicious traffic to an exposed server over the internet.
Linux Kernel Fixes Released
Linux maintainers have addressed the vulnerability with a patch that introduces additional validation to prevent checksum-processing operations from modifying protected IPv4 header fields.
The security fix has also been backported to supported stable kernel branches, with corrected releases including 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 and 7.2.11. Kernel maintainers have emphasized that the change provides an additional layer of protection, while more comprehensive validation of incoming packet metadata remains under development.
The discovery also highlights the increasing role of artificial intelligence in vulnerability research. Pwn.ai reported using an AI-assisted analysis framework to identify the underlying weakness within three days, with human researchers directing the investigation and validating the findings. Vercel’s two-week security challenge ultimately generated 1,285 vulnerability reports, including one critical finding, and resulted in $242,000 in bounty payments.
Organizations operating Linux-based virtualization infrastructure are advised to install updated host kernels or vendor-supplied patches and reboot affected systems. Updating a guest virtual machine alone does not address the vulnerable host kernel.
Leave a Reply