Critical Linux Kernel Flaw Exposes Host Memory to Guest VMs
A new vulnerability named PwnEscape allows malicious code in virtual machines to access sensitive data on the host system. The issue affects the Linux kernel's networking subsystem and has been confirmed by cloud providers.
TL;DR
- CVE-2026-99999, dubbed PwnEscape, impacts the Linux kernel's networking code.
- Allows guest virtual machines to read memory from the host system.
- Demonstrated against Vercel's cloud sandboxes, which confirmed the exploit.
- Affects shared infrastructure across multiple cloud environments.
- Organizations should monitor updates and apply patches promptly.
Security researchers have uncovered a severe vulnerability in the Linux kernel that could allow virtual machine guests to access sensitive data stored in the memory of host systems. Dubbed PwnEscape and tracked as CVE-2026-99999, the flaw resides in the kernel's networking subsystem.
This cross-privilege breach was demonstrated in real-world conditions against Vercel’s live cloud sandbox environment. Vercel has since verified the exploit, raising concerns for organizations relying on shared infrastructure where such isolation is assumed.
Technical Breakdown
- The vulnerability exists in the Linux kernel's networking code, making it independent of specific cloud configurations.
- It enables unauthorized read access from a guest VM to the host's physical memory.
- Attackers exploiting this flaw could potentially extract sensitive information like encryption keys or credentials.
Impact and Mitigation
- Because the bug is in the core kernel, it affects many Linux-based cloud and virtualized environments.
- Vercel confirmed exploitation in their sandboxed containers, indicating broad applicability.
- Immediate patching and monitoring are advised once vendor fixes become available.
- Organizations using Linux VMs should assess exposure and consider network segmentation as a temporary control.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.