Critical Linux Kernel Flaw Lets Guest Virtual Machines Read Host Memory

A critical vulnerability in the Linux kernel — tracked as CVE-2026-99999 and nicknamed PwnEscape — allows code running inside a virtual machine to read memory on the host computer, researchers confirmed on October 15, 2026.

Security researcher Paulos Yibelo of pwn.ai demonstrated the flaw against Vercel's live cloud sandboxes, and Vercel confirmed the memory leak was real. The vulnerability sits in the Linux kernel's networking code — a shared layer that virtually every major cloud provider depends on to keep customer workloads isolated from one another.

The flaw was discovered during a bug bounty challenge and reported privately before any public disclosure. No evidence of real-world exploitation has been reported.

---

What PwnEscape Does and How It Was Found

Yibelo's technical write-up explained that specially crafted network packets sent from inside a virtual machine could accomplish three things: read the host's memory, crash the host, and execute code on it. All three capabilities stem from the same kernel flaw.

Each malicious packet could return approximately 32 bytes of host memory, and the process could continue indefinitely as long as packets kept flowing. Just two specially crafted packets were sufficient to crash a host and take down every sandbox running on it — a detail that underscores how destructive even minimal exploitation could be in a shared cloud environment.

The crash and code execution results were observed only on lab machines configured to mirror Vercel's environment. Yibelo was careful to note his findings represented "not a claim of root command execution in any vendor's production environment."

The Role of AI-Assisted Research

What made this discovery notable was the method behind it. Yibelo used an internal AI-assisted research system called Omega-Pwn, which incorporated elements of SingularityNET's OmegaClaw architecture and used GPT-5.6 Sol as its primary reasoning engine. The model handled source-code analysis while human researchers directed the investigation and validated findings against real kernel behavior.

"We directed the investigation, challenged its findings, and validated the interesting ones against actual kernel behavior on systems we controlled," Yibelo told The Hacker News.

The entire discovery took three days and cost under $700 in API tokens — a striking data point in an era when AI-assisted vulnerability research is rapidly maturing. This follows a separate case earlier in 2026 in which another research team used a large language model to access internal systems at OpenAI.

The implication is significant: critical kernel flaws that once required weeks of expert manual analysis can now be surfaced in days, at minimal cost. Security teams should treat this as a structural shift in the threat landscape, not an isolated incident.

Why This Matters Beyond Vercel

To appreciate the full scope of this vulnerability, it helps to understand the architecture it targets. Virtualization allows multiple isolated workloads to share the same physical hardware, but that isolation depends entirely on the integrity of the host kernel and its underlying software stack. You can explore the key advantages and risks of virtualization in cloud environments to understand why a flaw at this layer carries such broad consequences.

---

Severity, Scope, and Why This Reaches Beyond One Cloud Provider

The Linux kernel's maintainers assigned CVE-2026-99999 a severity score of 9.3 out of 10 — a Critical rating. The U.S. National Vulnerability Database had received the entry but had not yet completed its own review at time of publication.

The attack vector is listed as local. An attacker must already be running code inside a guest virtual machine to exploit the flaw. This is not a remotely exploitable vulnerability accessible from the open internet, and it does not appear in CISA's catalog of actively exploited vulnerabilities.

Vercel's sandbox architecture runs each customer's code in its own Firecracker microVM on bare-metal Amazon EC2 hosts. The flaw is not in Firecracker or Vercel's configuration — pwn.ai found no misconfiguration in Vercel's setup. The vulnerability lives in the Linux kernel networking code running on the host itself.

Because nearly every large cloud platform uses the same Linux kernel layer to separate customer workloads, Vercel noted the flaw poses a risk to shared infrastructure broadly rather than to any single provider. Vercel also confirmed that no report from the challenge showed anyone accessing a customer's files, secrets, or application data.

The Broader Cloud Security Context

This vulnerability is a sharp reminder of the persistent security challenges that exist across shared cloud computing infrastructure. When a flaw sits in a kernel networking layer common to nearly all major providers, the blast radius extends far beyond any single vendor's customers. Multi-tenant cloud environments are structurally dependent on kernel-level isolation holding firm — and PwnEscape demonstrates what happens when it does not.

How the Hypervisor Layer Relates

The host kernel and the hypervisor layer above it work in concert to enforce isolation between guest virtual machines and the underlying hardware. Understanding how a hypervisor controls and separates virtual machine environments clarifies why a vulnerability in the host kernel's networking code can bypass those boundaries entirely — the hypervisor cannot compensate for a flaw in the layer it depends on.

---

The Fix, Affected Versions, and What Administrators Should Do

The patch is a single Linux kernel commit — 6785011f8b16 — authored by Red Hat's Michael S. Tsirkin and merged into the mainline kernel. It adds a check preventing a packet's checksum data from pointing into the IPv4 header before the kernel processes it, and applies that check at five locations in the networking code.

The author described the fix as "a defence in depth measure" and acknowledged that a more comprehensive check on packet ingress still requires additional work. Maintainers backported the fix to all supported stable branches.

First Fixed Versions

• 5.10 → 5.10.272
• 5.15 → 5.15.223
• 6.1 → 6.1.190
• 6.6 → 6.6.159
• 6.12 → 6.12.113
• 6.18 → 6.18.57
• 7.2 → 7.2.11

What Administrators Must Do Now

Administrators should update the host kernel to a fixed version and reboot. Updating only a guest kernel does not address the vulnerability on the host — this distinction is critical and commonly misunderstood. Linux distributions frequently backport fixes without changing version numbers, so administrators should consult their distribution's security advisory rather than relying solely on the version reported by uname. Red Hat, Debian, Ubuntu, and SUSE each maintain dedicated security advisory portals where backported patch status is tracked accurately.

No standalone workaround is available for environments where immediate patching is not possible. Vercel keeps host kernels current, disables nested virtualization, and runs each microVM under Firecracker's jailer — granting the microVM process only the permissions it requires. These measures narrow potential impact but do not eliminate the underlying vulnerability.

Background and Discovery Context

The flaw was found during a two-week Vercel security challenge held in August that offered up to $1 million in total rewards. Vercel paid $242,000 across 1,285 reports. PwnEscape was the only Critical finding in the entire challenge and earned the top per-report reward of $50,000.

Three Practical Takeaways for Security and Infrastructure Teams

For security teams and system administrators, this case carries three implications worth internalising.

First, host kernel patching is a distinct and non-negotiable action — guest-level updates do not substitute for it. The boundary between guest and host must be treated as a separate patching surface with its own update cadence and verification process.

Second, AI-assisted vulnerability research is now capable of finding critical kernel flaws rapidly and cheaply. Defenders should expect the pace of discovery to accelerate and plan detection and response timelines accordingly.

Third, defence-in-depth controls — process jailing, privilege restriction, and microVM isolation — remain valuable even when a patch exists. They limit the damage an attacker can cause if exploitation occurs before patching is complete, and PwnEscape demonstrates that even a well-configured environment benefits from layered constraints.