PwnEscape: Critical Linux Kernel Flaw Lets a Virtual Machine Read Memory on Its Host

A newly disclosed critical flaw in the Linux kernel, tracked as CVE-2026-99999 and nicknamed PwnEscape, allows code running inside a virtual machine to read memory on the host computer beneath it. The problem sits in the kernel's networking code rather than in any one cloud's setup, so it affects the shared layer that cloud providers use to keep customers' workloads apart. The kernel's maintainers rated it 9.3 out of 10 (Critical). The U.S. National Vulnerability Database had received the entry but had not finished its own review.

Researcher Paulos Yibelo of pwn.ai found the issue during a Vercel security challenge and reported it privately before any public release. He showed that specially made network packets sent from inside a virtual machine could leak host memory, crash the host, or run code on it. Vercel confirmed the memory leak against its production sandboxes, where each packet could carry back about 32 bytes of host memory. The crash and the administrator-level takeover were seen only on the researcher's own lab machines, which were set up to match Vercel's. He stressed this was not a claim of root access in any vendor's production environment.

There is no sign the flaw has been used in a real attack, and Vercel said no report in the challenge showed anyone reading a customer's files, secrets, or application data.