Full Report
A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it. The flaw, now tracked as CVE-2026-99999 and nicknamed PwnEscape, is in the Linux kernel's networking code, not in any one cloud's setup, so it reaches the shared
Analysis Summary
# Vulnerability: PwnEscape Linux Kernel Guest-to-Host Information Leak
## CVE Details
- **CVE ID**: CVE-2026-99999
- **CVSS Score**: 9.3 (Critical)
- **CWE**: Not explicitly listed (Involves improper validation of packet checksum data/memory boundary checks)
## Affected Systems
- **Products**: Linux Kernel (Networking subsystem)
- **Versions**: All versions prior to the integration of commit `6785011f8b16`. Specific stable branch backports include the "First fixed version" for each respective branch (e.g., mainline and backported stable releases).
- **Configurations**: Environments where untrusted guest code runs in virtual machines (e.g., Firecracker microVMs, Amazon EC2, Vercel Sandboxes) utilizing shared Linux kernel networking layers.
## Vulnerability Description
PwnEscape is a flaw in the Linux kernel’s networking code. It occurs because the kernel fails to adequately validate that a packet's checksum data does not point into the IPv4 header. By sending specially crafted network packets from within a guest VM, an attacker can trigger the host kernel to leak approximately 32 bytes of host memory per packet. In laboratory settings, this flaw was also shown to cause host crashes (DoS) and potential arbitrary code execution by breaking out of the VM sandbox.
## Exploitation
- **Status**: PoC available (demonstrated by pwn.ai in a controlled security challenge); No evidence of exploitation in the wild.
- **Complexity**: High (Requires sophisticated packet crafting and reasoning to achieve code execution).
- **Attack Vector**: Local (Attacker must already have the ability to run code/processes within a guest VM).
## Impact
- **Confidentiality**: High (Ability to read host memory from a guest VM).
- **Integrity**: High (Demonstrated potential for administrative control/VM escape in lab settings).
- **Availability**: High (Two crafted packets can crash the host and all hosted sandboxes).
## Remediation
### Patches
- **Mainline Kernel**: Fixed in commit `6785011f8b16abf40b1e9d8b2e332232b3e68822`.
- **Stable Branches**: Users should update to the latest stable Linux kernel release containing the backported fix from Red Hat.
### Workarounds
- No specific software workarounds are listed; however, hardening the virtualization layer and monitoring for unusual internal network traffic may provide defense-in-depth.
## Detection
- **Indicators of Compromise**: High volumes of malformed IPv4 packets with anomalous checksum pointers originating from guest VMs.
- **Detection methods**: Monitoring for host-level kernel oops or unexpected memory access patterns in the networking subsystem.
## References
- **Vendor Advisory**: hxxps[://]vercel[.]com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge
- **Technical Write-up**: hxxps[://]pwn[.]ai/blog/pwnescape
- **Kernel Commit**: hxxps[://]github[.]com/torvalds/linux/commit/6785011f8b16abf40b1e9d8b2e332232b3e68822
- **NVD Listing**: hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-99999