Ethical Hacking News
A critical Linux kernel vulnerability known as PwnEscape has been discovered, allowing code inside a virtual machine to read memory on the host computer it runs on. The vulnerability was found in the Linux kernel's networking code and was demonstrated against Vercel's live cloud sandboxes. The fix for the vulnerability is a single Linux kernel change that adds a check to prevent packets from pointing into the IPv4 header. Updating the host kernel to one of the fixed versions above can fix the vulnerability. However, the discovery highlights the need for cloud providers to prioritize security and to work together to address shared vulnerabilities.
The PwnEscape vulnerability is a critical Linux kernel vulnerability that allows code inside a virtual machine to read memory on the host computer. The vulnerability was found in the Linux kernel's networking code and can be used to read host memory, crash the host, and run code on it. The vulnerability is a concern for shared infrastructure as it affects all cloud providers that use the same Linux kernel. The fix for the vulnerability is a single Linux kernel change that adds a check to prevent packet-related exploits. Updating the host kernel to a fixed version can fix the vulnerability, but updating only a guest's kernel does not. Cloud providers are advised to prioritize security, keep Linux kernels up to date, and use security measures like nested virtualization and jailer-like systems to limit the impact of such vulnerabilities.
The cybersecurity landscape has been shaken to its core with the recent discovery of a critical Linux kernel vulnerability known as PwnEscape. This newly disclosed flaw, tracked as CVE-2026-99999, allows code inside a virtual machine to read memory on the host computer it runs on, sending shockwaves throughout the industry. The vulnerability was found in the Linux kernel's networking code, not in any one cloud's setup, making it a concern for shared infrastructure.
According to the research firm pwn.ai, which discovered the vulnerability, specially crafted network packets sent from inside a virtual machine could do three things: read the host's memory, crash the host, and run code on it. All three of these actions come from the same kernel flaw. Vercel, a cloud sandboxes provider, was among the first to demonstrate the leak against its live cloud sandboxes. The company confirmed that the flaw was found in its security challenge and reported privately before any public release.
Paulos Yibelo, the researcher who discovered the PwnEscape vulnerability, explained that the flaw was demonstrated against Vercel's production sandboxes. Each packet the guest sent out could carry back about 32 bytes of the host's memory, and the guest could keep going as long as it kept sending packets. The crash and code execution were observed only on the researcher's own machines, which were set up to match Vercel's.
Vercel said no report in the challenge showed anyone reading a customer's files, secrets, or application data. However, the company also noted that the vulnerability was not in its sandbox's setup but in the Linux kernel's networking code, which is shared among cloud providers. This means that the vulnerability poses a risk to shared infrastructure rather than to any one provider.
The fix for the PwnEscape vulnerability is a single Linux kernel change, commit 6785011f8b16, written by Red Hat's Michael S. Tsirkin and merged into the mainline kernel. The change adds a check that a packet's checksum data cannot point into the IPv4 header before the kernel acts on it, and applies that check at five places in the networking code.
The change is deliberately partial, with its author calling it "a defence in depth measure" and noting that a fuller check on the way packets enter the kernel still needs work. The maintainers backported the fix to the stable kernel branches.
Linux distributions ship their own kernels and often add this kind of fix without changing the version number, so check your distribution's advisory and whether the fix is in the kernel the host is actually running, not only the number from uname.
Updating the host kernel to one of the fixed versions above, or to the vendor build that includes the fix, and rebooting into it, can fix the vulnerability. However, updating only a guest's kernel does not fix the host. The usual step when patching has to wait is to limit what a break-in could reach. Vercel said it keeps host kernels up to date, disables nested virtualization, and runs each microVM under Firecracker's jailer, which grants the microVM process only the permissions it needs.
The PwnEscape vulnerability was found in a two-week challenge that Vercel ran in August, offering up to $1 million in total to anyone who could break out of its sandbox. No single payout reached that figure. The top reward per report was $50,000; Vercel paid $242,000 across 1,285 reports, and this flaw was the one critical finding.
pwn.ai said it found the flaw in three days using its own AI-assisted research system, with the model doing the source-code analysis and human researchers directing the work. The firm put the cost at under $700 in API tokens. It was the latest case of researchers using a large language model to help find and chain real flaws, after a separate team used one earlier this year to reach internal systems at OpenAI.
The PwnEscape vulnerability highlights the need for cloud providers to prioritize security and to work together to address shared vulnerabilities. It also underscores the importance of keeping Linux kernels up to date and of using security measures such as nested virtualization and jailer-like systems to limit what a break-in could reach.
In conclusion, the PwnEscape vulnerability is a critical concern for the cybersecurity industry. Its discovery highlights the need for cloud providers to prioritize security and to work together to address shared vulnerabilities. It also underscores the importance of keeping Linux kernels up to date and of using security measures such as nested virtualization and jailer-like systems to limit what a break-in could reach.
Related Information:
https://www.ethicalhackingnews.com/articles/Critical-PwnEscape-Linux-Kernel-Vulnerability-Exposed-A-New-Dawn-for-Cybersecurity-ehn.shtml
https://thehackernews.com/2026/10/critical-pwnescape-linux-kernel.html
Published: Thu Oct 15 16:29:49 2026 by llama3.2 3B Q4_K_M
