Science & Tech · Cybersecurity · 7 hrs ago
Critical Linux flaw may let virtual machines break into host systems
A critical Linux kernel flaw called PwnEscape may let an attacker break out of a virtual machine and affect the host computer.
The flaw is in Linux networking code and is rated 9.3 out of 10 for severity.
An attacker must already be able to run code inside a virtual machine, so the flaw cannot be triggered by an outsider simply sending packets over the internet.
A researcher demonstrated host-memory leaks in Vercel's live sandboxes, but the reported host crash and code execution were tested only on research machines, not in a provider's production system.
Vercel said no customer files, secrets or application data were shown to have been accessed, and there is no reported real-world exploitation.
The flaw could threaten shared cloud systems because many providers use Linux to separate customers' workloads.
Sakura Internet paused new applications for some services while investigating, while AWS said its managed compute and container services are not affected; users should check their provider's response and updates.
PwnEscape is a critical Linux kernel flaw that may let code running inside a virtual machine cross into the host system.
The vulnerability is tracked as CVE-2026-99999 and has a severity score of 9.3 out of 10.
A researcher demonstrated host-memory leaks against Vercel production sandboxes, while host crashes and code execution were shown only in a research lab.
The flaw is in Linux kernel networking code, and no real-world attacks have been reported.
Sakura Internet temporarily stopped accepting new server orders while it investigated the issue.
- Who
- Attackers already able to run code inside a guest virtual machine could exploit the flaw. Security researcher Paulos Yibelo demonstrated it.
- What
- PwnEscape may allow a guest virtual machine to read host memory, crash a host or execute code on it.
- When
- Disclosed in October 2026; the sources report no date for the research demonstration.
- Where
- The flaw is in Linux kernel networking code. A memory leak was demonstrated in Vercel production sandboxes.
- Why
- The kernel's handling of checksum-related data for validated IPv4 headers can be manipulated, disrupting network processing and enabling unexpected memory access.
This story does not have two clearly opposing sides.
The flaw was found in a Vercel security challenge and reported privately.
A researcher demonstrated host-memory leaks against Vercel's production sandboxes.
The researcher observed host crashes and host code execution on machines configured to match Vercel's.
Sakura Internet temporarily stopped accepting new server orders while investigating the vulnerability.
- Vulnerability
- PwnEscape, CVE-2026-99999
- Severity
- 9.3 out of 10, Critical
- Affected component
- Linux kernel networking code
- Memory leaked per packet
- About 32 bytes of host memory
- Sakura Internet response
- Temporarily paused new server orders on October 16, 2026
4 sources
What people are saying
not a claim of root command execution in any vendor's production environment.
Although we suspect the security industry will use this post to figure out the other affected hypervisors and we expect exploits in weaker configurations to arrive in weeks, and exploits working in default hypervisor configurations to arrive in under a month.
AWS-managed compute and container services, including Amazon EC2 instances, AWS Lambda, and AWS Fargate, are not affected. There is no action required for customers using these services.