Critical Pwn Escape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory

Summary: A critical Linux kernel flaw tracked as CVE-2026-99999 and nicknamed PwnEscape lets code inside a virtual machine read host memory, crash the host, and run code on it; researcher Paulos Yibelo of pwn.ai demonstrated the memory leak against Vercel's production sandboxes, with each packet carrying back about 32 bytes of host memory. The flaw sits in the kernel's networking code rather than any one provider's setup, was rated 9.3 out of 10 with a local attack vector, and is fixed by commit 6785011f8b16, which adds a checksum check at five places in the networking code.
What you should know: Two crafted packets were enough to crash a host and take down every sandbox running on it, and because nearly every large cloud separates customer workloads on this same kernel layer, the exposure is shared infrastructure rather than one vendor's problem. The fix is deliberately partial, described by its author as a defence in depth measure, and updating only a guest's kernel does nothing for the host.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-99999
Related: ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026