PwnEscape Linux Flaw Enables Guest-to-Host Virtual Machine Escape

A critical Linux kernel vulnerability dubbed PwnEscape could allow an attacker running code inside a virtual machine to read host memory, disrupt the host or potentially execute code beyond the virtual machine’s isolation boundary. Tracked as CVE-2026-99999, the flaw affects the Linux networking stack and has been demonstrated in controlled laboratory tests.

The vulnerability carries a CVSS 3.1 score of 9.3 out of 10. Security researcher Paulos Yibelo discovered the issue while participating in Vercel’s sandbox security challenge, which invited researchers to test whether they could break through the isolation protecting virtualised workloads.

The flaw is particularly relevant to cloud providers and organisations operating their own virtualisation infrastructure. However, exploitation requires an attacker to already have code execution inside a guest environment. No real-world exploitation has been publicly reported.

How PwnEscape Crosses the Isolation Boundary

PwnEscape exploits how the Linux kernel handles metadata associated with network packet checksums. The kernel can defer checksum calculations until a later stage of packet processing, using metadata to determine where the calculation begins and where the result is written.

In the vulnerable code path, attacker-controlled metadata could cause a later checksum operation to modify an IPv4 header after the kernel had already processed it. Subsequent networking operations then relied on the changed header without adequately revalidating it.

The researcher demonstrated that this sequence could expose 32 bytes of adjacent host memory through an outgoing packet. The disclosure provided a starting point for further exploitation, which Yibelo subsequently demonstrated on researcher-controlled systems.

The underlying problem is in the Linux networking stack rather than a single hypervisor product. As a result, affected virtualisation environments may include systems built around KVM and virtual machine monitors such as Firecracker.

Researchers Demonstrate a Full VM Escape

The investigation progressed beyond memory disclosure. In a controlled laboratory setup, the researcher combined the vulnerability with additional techniques to demonstrate selected writes to host kernel memory and execute a host-root helper.

This established a guest-to-host escape under the tested conditions. It did not demonstrate that attackers had achieved the same outcome against customer workloads in production environments.

Vercel said the finding was the most severe submitted through its sandbox security challenge. The company also stated that the investigation had not identified access to customer data in Vercel Sandbox.

The distinction matters for cloud security teams: the research demonstrates a credible way to cross a fundamental isolation boundary, but it does not establish widespread exploitation or compromise of cloud customers.

Linux Kernel Fixes Address the Vulnerability

Linux kernel maintainers have published fixes across multiple stable branches. The Linux kernel security announcement lists fixed versions including 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 and 7.2.11, alongside a mainline fix.

Administrators should identify the kernel versions running on their virtualisation hosts and apply the appropriate updates supplied by their Linux distribution or vendor. Version numbers and backport status can vary between distributions, so operators should follow the relevant vendor security advisory rather than relying only on the upstream version number.

AWS has said its managed EC2, Lambda and Fargate services are not affected. Its advisory identifies self-managed KVM virtual machines using the affected networking path as the relevant concern.

Cloud Operators Face a Core Isolation Risk

Virtual machines are widely used to separate customers, workloads and applications on shared infrastructure. A guest-to-host escape can undermine that separation, potentially exposing host memory or allowing activity outside the compromised guest.

The immediate priority is to establish whether self-managed hosts use affected kernel builds and to apply the available fixes. Organisations should also review vendor advisories for their specific hypervisor and sandbox configurations.

Conclusion

PwnEscape shows how a flaw in a shared operating-system component can threaten virtual machine isolation even when the hypervisor itself is not the source of the vulnerability. Although no real-world exploitation has been publicly reported, the demonstrated escape and critical severity make timely patching important for operators of affected self-managed infrastructure.