Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory
A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it. The flaw, now tracked as CVE-2026-99999 and nicknamed PwnEscape, is in the Linux kernel's networking code, not in any one cloud's setup, so it reaches the shared
A critical vulnerability in the Linux kernel, known as PwnEscape, enables virtual machine code to access the host computer's memory. Discovered by pwn.ai researcher Paulos Yibelo, the flaw is present in the networking code, shared across cloud providers to isolate workloads. Vercel, a cloud service provider, confirmed the leak against their live sandboxes and assigned the vulnerability CVE-2026-99999, rating it Critical.
The vulnerability allows a guest VM to read host memory, crash the host, and execute code on it, transmitted through specially crafted network packets. Each packet can carry up to 32 bytes of host memory, and with two packets, the guest can crash the host and gain administrator control. Despite no real-world attacks reported, Vercel's researchers demonstrated the flaw using their Omega-Pwn tool.
The fix involves a single Linux kernel change, which backports to stable kernel branches. Although updating the kernel is the recommended solution, Vercel maintains its systems with up-to-date kernels, disables nested virtualization, and utilizes Firecracker's jailer to limit potential damage.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
