Linux Kernel Flaw PwnEscape Let a Guest VM Read Host Memory in Vercel's Live Sandboxes

A researcher at the security firm pwn.ai showed that code running inside a virtual machine could read memory belonging to the host computer underneath it. Vercel confirmed the leak against its live production sandboxes.

The flaw is tracked as CVE-2026-99999 and nicknamed PwnEscape. It was publicized Oct. 15.

It lives in the Linux kernel's networking code, not in any one hypervisor or cloud provider's setup. That puts it in the shared layer cloud companies lean on to keep customers' workloads apart.

What the researcher found

Paulos Yibelo of pwn.ai found the bug during Vercel's $1 million Sandbox security challenge and reported it privately before any public release. According to the challenge's reporting, the two-week program drew 1,285 reports and paid out $242,000 in bounties. Yibelo's was the only Critical finding, and Vercel called it its most important report.

Yibelo's write-up says specially made packets sent from inside a guest could do three things: read host memory, crash the host, and run code on it. All three trace to the same kernel defect.

The mechanism is checksum offload, a normal performance feature in which Linux delays calculating a packet's checksum. Packet metadata, including values called csum_start and csum_offset, tells the kernel where to write the finished checksum. A guest can influence those values.

The kernel validates the packet's IPv4 header early and treats it as a standard 20-byte header. Later, during fragmentation, the pending checksum write fires and changes the first byte of that header from 0x45 to 0x4f. That flips the header length from 20 bytes to 60. Nothing re-checks the header after the change.

The fragmenter then reads 32 bytes of adjacent host memory that were never part of the guest's packet and sends them out as if they were IP options. Yibelo and his colleagues describe it as a time-of-check/time-of-use problem. In their words: "Different parts of Linux were allowed to trust different versions of the same packet."

What was proven, and where

The memory leak was demonstrated against Vercel's production sandboxes. Each outbound packet could carry back about 32 bytes of host memory, and a guest could keep sending packets to keep reading.

The crash and the takeover were different. Both were shown only on Yibelo's own machines, configured to match Vercel's KVM and Firecracker setup. Two crafted packets were enough to crash a host and take down every sandbox on it.

Using the leak to map memory and control allocation behavior, the researchers say they chained selected 64-byte kernel writes to run a host-root helper. They report completing the guest-to-host escape across four separate cold boots.

Yibelo stressed this was a lab result, "not a claim of root command execution in any vendor's production environment."

Vercel said no report in the challenge showed anyone reading a customer's files, secrets, or application data.

Severity and limits

The kernel's maintainers rated the flaw 9.3 out of 10, Critical. The National Vulnerability Database has received the entry but had not finished its own review.

The published record lists the attack vector as local. The attacker must already be running code inside a guest, as Yibelo was. An outsider cannot exploit it by firing packets across the open internet.

The flaw is not in CISA's catalog of actively exploited vulnerabilities, and no real-world use has been reported.

The researchers' own report also stops short of claiming every Linux VM or hypervisor is equally exposed. A memory leak is a serious primitive, but the report says further steps were needed to turn it into host control.

The high score still reflects where the bug sits. Cyber Kendra's account describes it as breaking the isolation boundary that separates tenants on nearly every major cloud. Vercel treated it as a shared-infrastructure risk, not a Vercel-only problem.

Who has to patch

The bug is in the host's kernel networking stack. As the account @vuln_tracker put it on X, updating a guest kernel doesn't fix it, and anyone renting VMs depends on their provider's host patching.

Fixes have shipped in the stable kernel branches. Among the affected ranges: 5.10 through 5.10.271 (fixed in 5.10.272), 5.15 through 5.15.222 (fixed in 5.15.223), 6.1 through 6.1.189 (fixed in 6.1.190), and 6.6 through 6.6.158 (fixed in 6.6.159). Newer branches also have fixed releases.

Yibelo said his team used an internal harness called Omega-Pwn, which combines its own tooling with elements of SingularityNET's OmegaClaw architecture. He said GPT-5.6 Sol was the primary reasoning engine. "We directed the investigation, challenged its findings, and validated the interesting ones against actual kernel behavior on systems we controlled," he told The Hacker News.

The open items are concrete. The NVD has not completed its review of the 9.3 rating. Operators of hosts on the affected kernel branches have to move to the fixed releases, since guests cannot patch this themselves.