Each packet the guest sent out could carry back about 32 bytes of the host's memory, according to Vercel's report on a security challenge that uncovered a new Linux kernel flaw now tracked as CVE-2026-99999 and nicknamed "PwnEscape."
What Paulos Yibelo and pwn.ai demonstrated
Paulos Yibelo of the security firm pwn.ai reported that specially crafted network packets sent from inside a virtual machine could do three distinct things: read the host's memory, crash the host, and run code on it. Vercel confirmed the memory-leak demonstration against its production sandboxes and said each packet returned roughly 32 bytes of host memory and could be repeated indefinitely.
The crash and code-execution outcomes were observed by the researcher on lab machines configured to match Vercel's environment. According to the write-up, two specially crafted packets were sufficient to crash a host and take down every sandbox running on that host. Using the same underlying kernel flaw, the researcher reached administrator control of a host and broke out of the microVM — a result he described as a lab demonstration and explicitly framed as "not a claim of root command execution in any vendor's production environment."
Yibelo detailed the tooling used: "Our research ran through Omega-Pwn, an internal harness combining our own security research tooling with elements of SingularityNET's OmegaClaw architecture. It let us carry hypotheses, code traces, failed attempts, and experimental results across long-running research sessions. GPT-5.6 Sol was the primary reasoning engine. We directed the investigation, challenged its findings, and validated the interesting ones against actual kernel behavior on systems we controlled," he told The Hacker News.
Why PwnEscape reaches beyond Vercel
The flaw lies in the Linux kernel's networking code that the host runs, not in a single cloud provider's configuration. Vercel Sandbox runs each customer's code in a Firecracker microVM on bare-metal Amazon EC2 hosts; the microVM provides a separation between customers, but the vulnerability sits under that wall in the host kernel. pwn.ai said Vercel's sandbox was already hardened beyond normal industry standards and found no misconfiguration that caused the issue.
Kernel maintainers rated CVE-2026-99999 as 9.3 out of 10 (Critical) in the published record. The U.S. National Vulnerability Database had received the entry but had not completed its own review at the time of reporting. The CVE record lists the attack vector as local — an attacker must already be running code inside a guest. The vulnerability is not in CISA's catalog of actively exploited vulnerabilities, and there are no reports of real-world use.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleThe fix: commit 6785011f8b16 and what it changes
Red Hat's Michael S. Tsirkin authored the single-kernel change that fixes the issue (commit 6785011f8b16). The patch adds a check to ensure a packet's checksum data cannot point into the IPv4 header before the kernel acts on it, applying that check at five places in the networking code. The author described the change as "a defence in depth measure" and noted that a fuller check on the way packets enter the kernel still needs work.
Maintainers backported the fix to the stable kernel branches. Because Linux distributions ship their own kernels and sometimes incorporate fixes without changing the output of uname, operators must check the distribution advisory and confirm whether the fix is present in the kernel the host is actually running, not only the kernel version string.
Vercel's operational mitigations and limits of those steps
Vercel said it keeps host kernels up to date, disables nested virtualization, and runs each microVM under Firecracker's jailer, granting the microVM process only the permissions it needs. Those controls, Vercel noted, do not fix the kernel bug itself but narrow what an attacker who exploited it could achieve.
Vercel also reported that none of the challenge submissions it accepted showed anyone reading a customer's files, secrets, or application data.
What this means for cloud providers, security teams, and customers
- Cloud providers: Patch host kernels to the fixed mainline or vendor builds that include commit 6785011f8b16 and backports; verify the fix is deployed in the kernels actually running on host fleets.
- Security and operations teams: Prioritize updating host kernels and rebooting into them — updating guest kernels does not remediate the host-side vulnerability — and maintain mitigations such as disabling nested virtualization and using jailer-like restrictions while patches roll out.
- Customers of multi-tenant platforms: Note that Vercel said no challenge report showed exfiltration of customer data; nevertheless, because the flaw sits in the shared kernel layer that many clouds use to separate workloads, customers should ask providers which kernels and vendor builds are patched and when.
PwnEscape illustrates how a bug in a common, low-level subsystem can reach across the virtualized boundary that clouds rely on. A single, narrowly targeted kernel change has been merged and backported, but its author calls it a partial "defence in depth measure" and points to remaining work. Operators must apply vendor fixes and confirm deployment on hosts — because the vulnerability is in the host kernel, not in guests — or accept the continuing risk to shared infrastructure.
