A critical Linux kernel networking flaw nicknamed PwnEscape lets code inside a virtual machine read memory from the machine that hosts it. Vercel confirmed the leak in its production sandboxes, where each crafted packet returned about 32 bytes of host memory. The PwnEscape Linux kernel vulnerability was published on October 15, 2026, and a fix is already merged into mainline.
The bug sits in shared kernel code that large cloud providers use to keep customers apart. The Hacker News describes it as a critical issue that lets code in a guest VM read the host's memory. That reach extends beyond one company, which is why developers running untrusted code in cloud sandboxes should pay attention now.
What the PwnEscape Linux kernel vulnerability does
The flaw lives in the Linux kernel's networking code, which the host machine runs. It does not sit in the hypervisor. A program inside a guest virtual machine can use it to read memory that belongs to the host, according to The Hacker News and cisoai.au.
Researcher Paulos Yibelo of pwn.ai found the bug, according to cisoai.au's reporting. It surfaced during a Vercel security challenge, and the finder reported it privately to the company before any public release.
Secondary reports list the severity at 9.3 out of 10, which falls in the critical range, and attribute that score to the NVD entry, which lists a local attack vector. Bob Bragg's Daily Drop also carries the identifier CVE-2026-99999. The NVD record and the official scoring vector were not checked directly for this story, so treat the score as reported rather than confirmed. The identifier itself looks unusual, which is a reason to check it against NVD and kernel.org before citing it.
Lab tests went further than a read. In the researcher's own setup, the same flaw crashed the host and ran code on it, which would amount to a VM escape. Those machines were built to match Vercel's environment. Whether the same path works against a production host remains an open question.
How the leak showed up in Vercel's sandboxes
Vercel Sandbox runs each customer's code in its own Firecracker microVM on bare-metal Amazon EC2 hosts. That design keeps one customer's workload separate from another's, but it still depends on the host kernel. The exposure therefore reaches the host layer that cloud tenants share, as The Hacker News reports.
Vercel confirmed the memory leak against its production sandboxes. According to The Hacker News post on X, each crafted packet returned about 32 bytes of host memory. Thirty-two bytes sounds small. How much an attacker could assemble from repeated leaks depends on what sits in host memory at the moment, and the sources do not describe that.
Vercel said no report from the challenge showed anyone reading customer files, secrets or application data. The company also said there is no sign the flaw has been used in a real attack. Those statements come from Vercel and are not independent confirmation. A social post relaying Vercel's statement put the challenge prize at $1 million, a figure that also has not been checked against Vercel's own post.
Which systems need the fix
The fix is a single kernel commit, 6785011f8b16, written by Red Hat's Michael S. Tsirkin and merged into mainline. It adds a check in five places in the networking code. That check stops a packet's checksum data from pointing into the IPv4 header.
Distribution kernels may pick up the change on their own schedules, so a mainline merge does not tell you whether your server is patched. Check your vendor's advisory and confirm the running kernel includes the change.
| Who is affected | What to check | Action |
|---|---|---|
| Teams on managed cloud sandboxes or CI runners | Whether the provider's host kernels include commit 6785011f8b16 | Ask the provider in writing and record the answer |
| Companies running their own Linux virtualization hosts | Whether the running kernel includes the networking fix | Compare the kernel version with your distribution's advisory and patch |
| Consumers | No consumer-facing action has been reported | None |
Whether AWS and other large cloud providers have patched their host kernels is not stated in the sources reviewed for this story. Readers should not assume a major platform is covered until the provider confirms it.
Why a guest kernel update will not close the gap
Patching the kernel inside your own virtual machine does not fix this flaw. The vulnerable code runs on the host, so the host's networking stack has to be patched. Customers depend on the cloud provider's patch schedule and cannot push the fix themselves.
That sets PwnEscape apart from the emergency directives that US federal agencies received earlier in 2025 and 2026 to patch edge devices. The difference is ownership. A perimeter appliance is usually equipment the customer runs, while this code belongs to the provider's infrastructure. USA 24 covered a Palo Alto PAN-OS zero-day that came with a CISA deadline, which shows how those edge-device cases tend to unfold.
Patch queues are already heavy this month. Microsoft's record October 2026 Patch Tuesday fixed 1,413 CVEs, so security teams are triaging a large backlog while they assess cloud exposure.
Practical steps for teams running untrusted code
Start with your provider, then reduce what a compromised guest can reach.
- Ask your cloud or sandbox provider whether its host kernels include commit 6785011f8b16, and when they were updated. Get the answer in writing.
- Keep sensitive secrets out of shared sandboxes. Inject only the credentials a job needs at runtime, and use short-lived tokens.
- If the provider's patch is still pending, limit exposure. Restrict network paths from sandboxes, shorten credential lifetimes and avoid long-lived keys on CI runners.
- Ask whether the provider disables nested virtualization and runs each microVM under Firecracker's jailer. Vercel said it keeps host kernels current, disables nested virtualization and uses the jailer, according to The Hacker News.
- If you operate your own Linux hosts for virtualization, confirm the running kernel includes the change and record the version.
No consumer-facing action has been reported.
What to watch next
Three things will settle the open questions. First, the NVD and kernel.org records should confirm the CVE identifier, the score and the scoring vector. Second, cloud providers will need to say when their host kernels were patched, and that silence is the largest gap for customers today. Third, researchers will need to show whether a production host can be escaped, or whether the VM-escape results hold only in matched lab setups.
Vercel's statement that there is no sign of a real attack is the current baseline, not a guarantee. A public proof of concept would shorten the time defenders have to patch. The next few weeks will show whether cloud providers move quickly and whether the lab results hold up outside the researcher's machines.
