By Hamza Faisal
One of cloud computing's oldest promises — that virtual machines stay in their own lane — has just sprung a serious leak. Security researchers have disclosed PwnEscape, a critical flaw in the Linux kernel's networking stack that lets an attacker break out of a virtual machine and read or alter memory on the underlying host, simply by sending a few carefully crafted network packets. The bug carries a CVSS score of 9.3, and a tracking ID almost as striking: CVE-2026-99999.
The flaw was found by Paulos Yibelo, a researcher at the security firm pwn.ai, during Vercel's $1 million Sandbox security challenge, launched in August to stress-test the isolation of the company's sandbox infrastructure. The program drew 1,285 reports in two weeks — PwnEscape was the only one rated critical, and Yibelo received the maximum $50,000 reward. Vercel confirmed the memory leak on its live production sandboxes but said there was no sign anyone had accessed customer data.
How a packet rewrites the rulebook
What makes PwnEscape unnerving is where it lives. The bug is not in KVM, the hypervisor that powers most hyperscale clouds, but in the Linux kernel's networking stack itself. A deferred checksum operation lets a guest rewrite an IPv4 header after the kernel has already validated it as safe. Later, during output fragmentation, a pending checksum write fires and overwrites the header-length field — turning 20 bytes into 60 in the kernel's eyes — with nothing re-validating the header afterward. The fragmenter then reads 32 bytes of adjacent host memory it was never meant to see and ships them out on the wire as if they were legitimate IP options. The result is a repeatable, attacker-controlled read of host memory, which researchers showed can be chained toward full code execution on the host.
Because the attack travels through ordinary networking — something nearly every program inside a VM can reach — it needs no special privileges, no user interaction, and has low attack complexity, according to the CVE record.
A broad blast radius
PwnEscape affects KVM running on x86 CPUs, the most common setup in shared cloud environments, and also reaches Firecracker microVMs through the virtio-net/TAP path. Its impact radius spans cloud platforms, CI/CD pipelines, malware analysis tools and AI servers — anywhere untrusted code runs in a virtual machine next to other tenants. A successful host compromise could theoretically expose thousands of VMs or containers on the same machine.
There is some relief for managed services: AWS says its managed EC2, Lambda and Fargate offerings are not affected, though self-managed KVM and Firecracker deployments are. Linux kernels from 4.4 through 6.18 can be affected, and there are no listed workarounds — the only remediation is patching and rebooting.
Patched upstream, but not everywhere yet
The fix was accepted on October 8 and merged into the mainline Linux kernel on October 14, with stable-branch fixes across the 5.10, 5.15, 6.1, 6.6, 6.12, 6.18 and 7.2 lines. But several Linux distributions have not yet shipped the patched kernels to affected systems, leaving a window where vulnerable hosts remain exposed.
PwnEscape follows other KVM escapes disclosed earlier this year — ITscape, Januscape and Zapscape — but analysts consider it more dangerous because it targets the networking stack rather than narrow VM configuration quirks, making it far easier to exploit. For cloud operators, the message is blunt: patch now, reboot, and don't assume the sandbox walls are as thick as they look.
By Hamza Faisal
