- pwn.ai found a Linux kernel networking flaw, CVE-2026-99999, that let a guest VM read host memory. Vercel confirmed the leak in its production sandboxes.
- The flaw sits in the host kernel, outside the hypervisor. Isolation depends on that shared layer as well as on the virtual machine wall.
- Ask providers whether host kernels carry commit 6785011f8b16, and where you run code you do not trust.
A virtual machine is a wall between customers. But the wall stands on a floor, and the host operating system built that floor. The PwnEscape research shows what happens when the floor has a crack: the wall can be sound and still not hold.
What the researchers found
Paulos Yibelo of pwn.ai found the flaw while working on Vercel's $1 million Sandbox challenge, announced on August 18, 2026. His team found the core primitive within three days. The researchers named the bug PwnEscape. Its official identifier is CVE-2026-99999.
The hypervisor, the software that runs virtual machines, is not at fault. The defect lives in the networking code of the Linux kernel that the host machine runs. pwn.ai described Vercel's setup as tighter than typical industry practice and said it found no configuration mistakes.
According to The Hacker News, every Vercel Sandbox customer gets a dedicated Firecracker microVM, a lightweight virtual machine, on bare-metal Amazon EC2 servers. That microVM is the wall. The flaw sits underneath it.
How a checksum note becomes a memory leak
Linux does not always finish a packet's checksum straight away. It can carry the packet with a note that says: write the checksum at this position later. A guest VM can supply that note, so the host should treat it as untrusted.
The host first reads the packet's IPv4 header and decides it is 20 bytes long. Later, while splitting the packet into fragments, the function ip_do_fragment() completes the checksum before it reads the header length. If the note points into the header, the write changes the header's first byte. In the research case it moved from 0x45 to 0x4f, which turns a 20-byte header into a 60-byte one.
The packet's valid data was only 28 bytes. The kernel now copied 60. The extra 32 bytes came from host memory and went out on the wire as apparent IP options. The guest could read them.
Engineers know this shape as time-of-check to time-of-use: a value is checked, altered, then used. Picture a notary who stamps a contract, after which someone edits the page. Here nothing races. The ordinary sequence of networking steps creates the gap, and an attacker-influenced write lands inside it.
What was proven, and where
The evidence comes in tiers, and the tiers matter. The memory leak was demonstrated against Vercel's production sandboxes, according to The Hacker News, citing Vercel's report on the challenge. The guest could keep leaking as long as it kept sending packets.
The crash and the host takeover were shown only on the researchers' own machines. pwn.ai demonstrated selected 64-byte writes to host kernel memory there and used them to run a host-root helper. The researcher framed the takeover as a lab result. It is not evidence that anyone gained root on a vendor's live systems.
Vercel's account of the challenge says none of the submitted reports exposed a customer's files, secrets or application data. The kernel record rates the flaw 9.3 out of 10 and lists the attack vector as local. An attacker must already run code inside a guest. CISA's list of exploited vulnerabilities does not include the flaw, and no one has reported it being used in the wild.
A fix that is deliberately narrow
Michael S. Tsirkin of Red Hat wrote the patch, now upstream under commit ID 6785011f8b16. It adds one shared helper, ip_check_csum_start(), ahead of checksum completion in five places. The helper stops the write from landing inside the IPv4 header. The patch reached net.git on October 8 and the mainline kernel on October 14.
The commit message calls the change defense in depth and says broader validation of incoming data needs more work. pwn.ai adds that researchers raised separate concerns during upstream review about later changes to transport fields. It says those are not proven by this research and not covered by the IPv4 fix. pwn.ai also advises confirming stable backports and the official CVE entry in current kernel records, since both may change.
What this shows for leaders
The lesson is that isolation has layers you do not buy separately. Your provider's hypervisor choice matters. So does every part of the host kernel that a guest can reach, because the guest talks to all of it. The root problem, pwn.ai argues, was disagreement inside the kernel about what the packet looked like at each stage.
The research method is also a signal, though only one data point. Humans led the work and GPT-5.6 Sol served as the main reasoning engine. pwn.ai says the loop ran on under $700 of API tokens. That is the researchers' own figure.
Questions to put to your team
Ask every provider that runs your workloads whether its host kernels include commit 6785011f8b16, and when. Do not accept a general statement about hypervisor patching.
Map where you run code you do not trust. Customer-submitted code and output from AI agents both qualify. The local attack vector matters most there, because the attacker already sits inside a guest.
Ask what a host crash would take down. In the lab, two crafted packets crashed a host and every sandbox on it. Find out how your workloads are spread across hosts.
A strong wall protects only as much as the floor it stands on.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: pwn.ai (Paulos Yibelo).
