PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999)

In August 2026, Vercel launched a $1 million challenge to break the isolation boundary of its Sandbox product. This followed a recent AI security incident at OpenAI, where agents bypassed network restrictions, compromised internal infrastructure, and breached Hugging Face systems. The Vercel challenge explicitly invited researchers to attempt both network restriction bypassing and virtual machine escape.

The researchers took on the latter goal, discovering a vulnerability in Linux networking that allowed untrusted guest code to rewrite an IPv4 header after the kernel had already validated it. Initially, this appeared to be a 32-byte host-memory disclosure. However, this vulnerability eventually evolved into a full guest-to-host escape, affecting not only Vercel's sandbox but also many other hypervisor environments.

The vulnerability originated in the Linux networking stack, not the hypervisor itself. Despite Vercel's hardened sandbox, the team found no misconfigurations during their investigation. Vercel handled the vulnerability well, moving quickly to protect customers, conducting independent research, identifying affected hypervisors, and coordinating disclosure and fixes across the industry.

The researchers used Omega-Pwn, a research harness combining security architecture and automation, to explore attack paths and challenge assumptions. This tool enabled longer research horizons, persistent campaigns, parallel investigations, and the accumulation of evidence across complex research sessions. GPT-5.6 Sol served as the primary reasoning engine for source-level analysis.

The accepted Linux fix for this vulnerability is upstream commit 6785011f8b16, ipv4: validate checksum_start before completing checksum. This marks the first installment of the PwnEscape story, delving into the details of the vulnerable component in the host networking stack and its impact on Linux networking.