PwnEscape (CVE-2026-99999): Linux kernel networking flaw lets guest VMs leak host memory, demonstrated on Vercel sandboxes

Linha do tempo

1. theregister.com ↗ · pub. 18/10/2026 21:33 · coletado 19/10 17:54

   PwnEscape (CVE-2026-99999): critical Linux KVM guest-to-host escape via malformed IPv4 packets, CVSS 9.3

   ler a análise desta fonte ocultar

   Researcher Paulos Yibelo disclosed PwnEscape (CVE-2026-99999, CVSS 9.3), a critical guest-to-host escape flaw in Linux KVM. A guest can trigger it by sending a few malformed IPv4 packets. Red Hat says the impact can include arbitrary code execution on the host, denial of service, or disclosure of sensitive memory. Yibelo argues it exposes a new class of attacks in Linux networking, where untrusted checksum metadata rewrites packet fields after the kernel has already validated them. AWS says EC2 is not at risk, and Google Cloud is probably unaffected. The article does not report exploitation in the wild.

   Technical Details

   • If a packet with bad checksum metadata reaches the IPv4 stack, skb_checksum_help can corrupt the network header (per Michael S. Tsirkin of Red Hat).
   • SOC Prime explains that guest-controlled checksum-offload metadata can influence a write after the packet header has passed earlier validation.
   • The disclosure can be triggered repeatedly, so a guest workload could leak memory from a security domain it should not be able to inspect.
   • A host compromise could expose thousands of VMs and the containers running in micro-VMs.
   • Edera noted that researchers have found seven escape bugs this year, including Januscape, and that Linux's 40+ million lines of code form a large attack surface.

   Remediation

   • An upstream fix exists in the Linux kernel and is making its way into Debian, RHEL and Ubuntu.
   • It is also expected in KVM-based products such as Nutanix and Proxmox.
   • Apply kernel and hypervisor updates as soon as they are available.
2. thehackernews.com ↗ · pub. 15/10/2026 17:24 · coletado 19/10 17:53 primeiro registro

   PwnEscape (CVE-2026-99999): Linux kernel networking flaw lets guest VMs leak host memory, demonstrated on Vercel sandboxes

   Adds that the memory leak was demonstrated against Vercel's production sandboxes, which Vercel confirmed. It also adds the Vercel $1 million challenge origin, the local attack vector, and the lab-only status of host crash and code execution. The fix is identified as mainline commit 6785011f8b16 by Michael S. Tsirkin, backported to stable branches, a partial defence-in-depth check. The flaw is in the Linux kernel networking code rather than KVM specifically. Mitigations are Firecracker jailer and disabled nested virtualization. The discovery was AI-assisted by pwn.ai at under $700 in tokens. There is no CISA KEV listing and no real-world exploitation.

   ler a análise desta fonte ocultar

   Adds that the memory leak was demonstrated against Vercel's production sandboxes, which Vercel confirmed. It also adds the Vercel $1 million challenge origin, the local attack vector, and the lab-only status of host crash and code execution. The fix is identified as mainline commit 6785011f8b16 by Michael S. Tsirkin, backported to stable branches, a partial defence-in-depth check. The flaw is in the Linux kernel networking code rather than KVM specifically. Mitigations are Firecracker jailer and disabled nested virtualization. The discovery was AI-assisted by pwn.ai at under $700 in tokens. There is no CISA KEV listing and no real-world exploitation.

   A critical Linux kernel networking flaw, CVE-2026-99999 (nicknamed PwnEscape, CVSS 9.3), lets code inside a guest VM read host memory, crash the host and, in lab conditions, run code on it. Researcher Paulos Yibelo of pwn.ai demonstrated the memory leak against Vercel's production sandboxes, which Vercel confirmed. The flaw was found in a Vercel bug bounty challenge and reported privately. The attack vector is local, so the attacker must already run code in a guest. It is not in CISA's KEV catalog and no real-world exploitation has been reported. Because the bug sits in the shared Linux kernel layer that most large clouds use to isolate tenants, it is a risk to shared infrastructure rather than to one provider.

   Technical Details

   • Specially crafted network packets sent from inside a guest leak about 32 bytes of host memory per packet, repeatedly. Two crafted packets can crash a host and every sandbox on it.
   • Code execution and administrator control of a host were achieved only on the researcher's own lab machines, configured to match Vercel's. Yibelo stressed this is "not a claim of root command execution in any vendor's production environment."
   • Vercel said no report showed access to customer files, secrets or application data.
   • Vercel Sandbox runs each customer's code in a Firecracker microVM on bare-metal Amazon EC2 hosts. The flaw is in the host's Linux kernel networking code, not in Firecracker or in Vercel's configuration.
   • The fix is mainline commit 6785011f8b16, by Red Hat's Michael S. Tsirkin. It checks that a packet's checksum data cannot point into the IPv4 header, at five places in the networking code. The author calls it "a defence in depth measure" and says a fuller check on packet entry still needs work.
   • The fix was backported to the stable kernel branches.
   • pwn.ai says it found the bug in three days using an AI-assisted research harness (Omega-Pwn, with GPT-5.6 Sol as the reasoning engine) for under $700 in API tokens.
   • Vercel's challenge ran for two weeks in August. It paid $242,000 across 1,285 reports, and this was the only Critical finding.

   Remediation

   • Update the host kernel to a fixed stable version or a vendor build that includes the fix, and reboot into it. Updating only a guest kernel does not fix the host.
   • Distributions often backport fixes without changing the version number, so check the distribution advisory rather than relying on uname output.
   • No separate workaround is given.
   • Where patching must wait, limit the blast radius as Vercel does: keep host kernels current, disable nested virtualization, and run each microVM under Firecracker's jailer.