CVE-2026-99999: Critical PwnEscape Linux Kernel Flaw Enables Guest-to-Host Escape

A critical Linux kernel vulnerability tracked as CVE-2026-99999, dubbed PwnEscape, can break the isolation boundary between virtual machines and their underlying hosts. The flaw resides in the Linux networking stack and can allow attacker-controlled code running inside a guest VM to disclose host memory, crash the host, and, under demonstrated lab conditions, achieve guest-to-host code execution.

The vulnerability carries a CVSS 3.1 score of 9.3 and is particularly relevant to cloud providers, sandbox operators, CI/CD platforms, malware-analysis environments, and other organizations that execute untrusted workloads inside Linux-based virtual machines.

PwnEscape was discovered by security researcher Paulos Yibelo of pwn.ai while participating in Vercel’s $1 million Sandbox security challenge. The researcher demonstrated that specially crafted guest-originated network packets could repeatedly leak host memory from Vercel production sandboxes. The more advanced host-write and root execution chains were reproduced only on researcher-controlled systems and should not be interpreted as evidence of root compromise in Vercel’s production infrastructure.

The vulnerability does not originate in KVM, Firecracker, or a specific cloud platform. Instead, it exists in Linux IPv4 packet processing, meaning the underlying weakness may affect a wider range of virtualization and sandbox architectures that expose the relevant host networking path to guest-controlled traffic.

Organizations can leverage SOC Prime’s AI-Native Detection Intelligence Platform to strengthen their security posture against emerging threats and accelerate threat hunting and detection engineering across SIEM, EDR, XDR, and Data Lake environments.

Security professionals can also use Prime Architect to research emerging vulnerabilities, transform technical threat intelligence into detection logic, generate hunting queries, validate rules, and adapt detection content to organizational telemetry.

Contact Sales

CVE-2026-99999 Analysis

CVE-2026-99999 affects Linux kernel code introduced in version 2.6.27 and relates to improper validation of checksum metadata before IPv4 checksum completion. According to the Linux kernel CVE announcement, malformed checksum metadata entering the IPv4 stack can cause skb_checksum_help() to modify the network header after the kernel has already processed and trusted it.

The core issue involves deferred checksum processing. Linux allows network packets to carry metadata indicating where a checksum operation should begin and where its result should be written. This optimization is legitimate and widely used for checksum offloading, but the security problem arises when less-trusted guest-controlled metadata can influence a write after the packet header has already passed earlier validation stages.

In the PwnEscape research, a crafted packet initially presented a normal IPv4 header with an Internet Header Length (IHL) corresponding to 20 bytes. A later deferred checksum operation could modify the same header so that its IHL represented a 60-byte header. Subsequent fragmentation logic trusted this altered value and copied data beyond the packet’s valid logical contents.

The researcher demonstrated a 32-byte host-memory disclosure through this behavior. The malformed packet contained 28 bytes of valid linear packet data, while the modified header caused the kernel to treat 60 bytes as valid header content. The resulting difference exposed 32 bytes belonging to the host rather than the guest-controlled packet.

Because the disclosure could be triggered repeatedly, an attacker controlling a guest workload could potentially collect information from a security domain that the virtual machine should not be able to inspect. This represents a direct failure of the guest-host isolation boundary.

Researchers then extended the primitive in a controlled KVM environment. Using information obtained from host-memory disclosures and carefully manipulated memory allocations, they demonstrated selected host-kernel writes and ultimately executed a root-level helper on the host. The complete escape chain was reproduced across four cold boots of researcher-owned systems.

This distinction is important. The demonstrated memory disclosure was reproduced against Vercel’s live sandbox infrastructure, but the host-write and root execution stages were demonstrated only in controlled research environments. Vercel reported no evidence that the vulnerability exposed customer files, secrets, or application data.

The flaw therefore represents a guest-to-host escape primitive rather than a conventional remote-code-execution vulnerability reachable directly from the public internet. The official CVSS vector uses a Local attack vector because an attacker must first have the ability to execute code inside a guest environment capable of reaching the vulnerable host networking path.

This makes PwnEscape particularly relevant to multi-tenant infrastructure where running untrusted code is part of the intended service model. Cloud development sandboxes, build services, online coding platforms, malware sandboxes, serverless systems, and AI agent execution environments may intentionally provide users or automated workloads with guest-level code execution.

The vulnerability received a CVSS 3.1 score of 9.3 (Critical) with the vector AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The changed scope reflects the ability of malicious activity originating inside a guest security boundary to affect the host.

The Linux kernel CVE team states that the vulnerable behavior dates back to kernel 2.6.27. The issue was addressed through upstream commit 6785011f8b16, authored by Michael S. Tsirkin of Red Hat, which introduces validation ensuring that the checksum start position cannot point inside an already parsed IPv4 header.

The accepted fix applies the validation before checksum completion across five affected networking paths. However, upstream developers describe the change as a defense-in-depth measure and note that broader validation of malformed checksum metadata at ingress requires additional work.

The discovery timeline began shortly after Vercel launched its security challenge on August 18, 2026. pwn.ai submitted the initial bounded host-memory disclosure on August 20 and privately reported the Linux kernel root cause to kernel security contacts and networking maintainers on September 4. Michael S. Tsirkin reproduced the issue on September 7, and the final upstream fix was accepted into net.git on October 8 before being merged into Linus Torvalds’ tree on October 14. The CVE was publicly announced on October 15, 2026.

A CVE-2026-99999 PoC is effectively available through the technical PwnEscape research, which documents the packet manipulation and bounded host-memory disclosure in substantial detail. However, the researchers have not published the complete allocator-sensitive chain used to convert the disclosure into reliable host control, reserving those details for further research.

At the time of writing, there is no public evidence that PwnEscape has been exploited maliciously in real-world attacks, and it is not listed in CISA’s Known Exploited Vulnerabilities catalog.

For CVE-2026-99999 detection, security teams should prioritize visibility into suspicious behavior originating from untrusted virtual machines, unexpected host-kernel crashes associated with guest networking activity, malformed or anomalous IPv4 fragmentation behavior, and unusual host-side effects following network traffic generated by sandboxed workloads.

Unlike malware campaigns with stable file hashes or command-and-control infrastructure, exploitation occurs through kernel networking behavior. Detection therefore depends more heavily on host telemetry, virtualization monitoring, network anomalies, crash analysis, and correlation between guest activity and unexpected host behavior.

CVE-2026-99999 Mitigation

The Linux kernel CVE team recommends upgrading to the latest supported stable kernel containing the security fix rather than cherry-picking an individual commit. Kernel fixes are tested as part of stable releases, and Linux maintainers explicitly discourage treating isolated commits as independently supported patches.

The first fixed releases in currently listed upstream stable branches are:

• Linux 5.10: 5.10.272
• Linux 5.15: 5.15.223
• Linux 6.1: 6.1.190
• Linux 6.6: 6.6.159
• Linux 6.12: 6.12.113
• Linux 6.18: 6.18.57
• Linux 7.2: 7.2.11
• Mainline: 7.3-rc7

The fix may also be backported by Linux distributions without matching these exact upstream version numbers. Administrators should therefore consult their distribution’s security advisory and verify that the currently running host kernel contains the relevant patch rather than relying exclusively on the version shown by uname.

Importantly, organizations must update the host kernel. Updating only kernels running inside guest virtual machines does not eliminate the vulnerable host networking path described in the PwnEscape attack.

After installing an updated kernel, systems must be rebooted into the patched version. For large virtualization environments, security teams should verify the active kernel across every hypervisor or sandbox host rather than assuming that package installation alone completed remediation.

Organizations that operate multi-tenant or untrusted execution infrastructure should prioritize patching because those environments inherently give potentially hostile workloads the guest-level code execution required to reach the vulnerable attack surface.

Defense-in-depth measures can reduce the consequences of a possible escape while patching is being completed. Vercel, for example, uses Firecracker jailer restrictions, disables nested virtualization, and limits host permissions available to individual microVM processes. Such measures do not fix the kernel vulnerability, but they can reduce what a successful escape can access.

To Detect CVE-2026-99999 exploitation attempts, security teams should correlate guest-originated network activity with abnormal host behavior, particularly kernel crashes, unusual fragmentation events, unexplained host-memory exposure, or virtualization processes behaving unexpectedly after processing guest traffic.

There are currently no campaign-specific CVE-2026-99999 IOCs such as malicious hashes, domains, or attacker IP addresses because no real-world exploitation campaign has been publicly identified. Behavioral monitoring and verification of kernel patch status are therefore more useful than static indicator matching.

Cloud providers and organizations running untrusted customer workloads should also review kernel panic logs, hypervisor telemetry, host network traces, and historical crash events for anomalies temporally linked to guest-generated networking activity.

If suspicious activity indicates a possible escape, organizations should treat the underlying host as potentially compromised rather than isolating only the guest VM. Incident responders should preserve host memory and relevant network telemetry where practical, investigate other workloads running on the same system, and evaluate whether host credentials, secrets, or neighboring workloads could have been exposed.

SOC Prime’s AI-Native Detection Intelligence Platform can help security teams operationalize vulnerability intelligence and accelerate behavioral threat hunting across infrastructure, network, and endpoint telemetry while adapting detection content to available data sources.