PwnEscape (CVE-2026-99999) is a critical flaw in the Linux kernel’s networking code that lets code running inside a virtual machine read memory belonging to the host machine it runs on. Disclosed on October 15, 2026, the bug carries a CVSS score of 9.3 and affects the shared isolation layer nearly every major cloud provider relies on. Fixed kernel versions are already available, and administrators need to update and reboot their host machines as soon as possible. There is no guest-side workaround.
What PwnEscape is
Every public cloud runs your virtual machines on top of Linux. The guest VM you rent sits on a host machine, and the host’s Linux kernel keeps your workload separate from everyone else’s. PwnEscape breaks that separation from inside the guest.
The flaw lives in the kernel’s IPv4 networking stack, specifically in how checksum offload metadata is handled. A guest that controls the checksum fields on its own packets can change a network header after the kernel has already validated it. In practical terms, a tiny crafted packet makes the host’s kernel read about 32 extra bytes of its own memory and send them back to the guest as if they were legitimate packet data. Send enough packets, and an attacker can systematically scoop host memory from inside an ordinary VM.
Unlike earlier cloud bugs tied to one hypervisor or one provider’s setup, PwnEscape sits in core Linux code. That is what makes it far-reaching: any environment that runs vulnerable kernels to host virtual machines shares the same weakness.
How the bug was found
Security researcher Paulos Yibelo of the firm pwn.ai discovered PwnEscape during Vercel’s Sandbox security challenge, a two-week contest in August 2026 that drew 1,285 reports. This was the only one rated critical.
The research itself is a story about AI-assisted security work. Yibelo’s team used an internal harness called Omega-Pwn, with the AI model GPT-5.6 Sol as the primary reasoning engine, to trace hypotheses across long kernel-level sessions. According to pwn.ai, the flaw was identified in three days at a cost of under $700 in API tokens. Vercel confirmed the memory leak against its live production sandboxes and paid out from a $242,000 bounty pool.
The researcher demonstrated the memory leak against Vercel’s real infrastructure. He stressed, however, that the host crash and host-code-execution steps were lab-only results: on machines configured to match Vercel’s environment, two specially crafted packets crashed the host and took down every sandbox on it, and further work reached administrator control of the host. Nothing of the kind was performed against any vendor’s production systems, and Vercel said no report showed anyone reading customer files, secrets, or application data.
What the flaw actually does
PwnEscape gives an attacker inside a guest VM three capabilities, demonstrated in increasing severity:
- Host memory disclosure: about 32 bytes of host memory per crafted packet, repeatable as long as the guest keeps sending packets. Over time, an attacker can systematically scoop host memory from inside an ordinary VM.
- Host crash: in lab testing, just two crafted packets were enough to crash the host, taking down every VM running on it.
- Guest-to-host escape: in the researcher’s controlled lab environment, chained memory manipulation led to code running with host administrator privileges.
The key detail: the flaw was reported privately before any public release, and no one has reported it being used in a real attack.
Which systems are affected and which kernels fix it
The vulnerable code is in mainline Linux’s networking stack, in the deferred-checksum path that processes packets for virtual machines. The fix was applied to the net.git tree on October 8, 2026, and merged into the mainline kernel tree on October 14.
Backports reached all active stable branches quickly. Fixed versions include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, and 7.2.11. One caveat administrators should know: many distributions apply security patches without changing the reported kernel version number, so check your vendor’s specific build rather than relying on the raw version string.
Red Hat researcher Michael S. Tsirkin authored the mainline fix, described as a defense-in-depth measure that tightens IPv4 header checksum pointer checks in five places.
Major cloud providers are rolling out patched hosts. AWS has indicated its managed EC2, Lambda, and Fargate services are unaffected. If you run your own KVM hosts or use a smaller provider, confirm with them directly.
What to do right now
If you run virtualization hosts, this one is straightforward but urgent:
- Patch the host kernel to a fixed version listed above (or your distribution’s patched build) and reboot the host. There is no workaround: guest-side patches and configuration changes do not mitigate PwnEscape, because the vulnerable code runs on the host.
- Schedule the reboot. The patch only takes effect after the host restarts, so plan a maintenance window. All VMs on the host will be affected during the reboot.
- Verify the patch landed. Confirm your running kernel includes the backported fix using your distribution’s security advisory, not just the version number.
- Cloud customers: ask your provider for their patching timeline if they have not announced one. The largest providers typically patch silently, but smaller and regional providers may need a nudge.
There is currently no evidence of in-the-wild exploitation, so this is a preventive action, not an incident response. That is the best time to patch.
Why PwnEscape matters beyond one vendor
Two things make PwnEscape stand out. First, the location: the networking stack of the shared host kernel, not any one company’s sandbox or hypervisor. Bugs in this layer automatically affect everyone who shares it. Second, the discovery method: an AI-assisted harness found a subtle timing inconsistency in kernel packet validation in three days for less than the cost of a laptop. That cost curve changes how quickly flaws like this will be found in the future, and it is one more reason to keep host kernels current.
This flaw also arrives close on the heels of another guest-to-host escape found by the same researcher in Vercel’s challenge earlier this month, which involved a KVM zero-day VM escape. The two bugs are different technically, but together they underline where the soft spots in cloud isolation keep appearing: the boundary code between guest and host.
If your patch planning starts with a priority list, pair this one with the current October 2026 Patch Tuesday guidance and the actively exploited BeyondTrust zero-day disclosed the same day, so your team fixes the internet-facing and infrastructure flaws together.
Frequently asked questions
What is PwnEscape?
PwnEscape (CVE-2026-99999) is a critical Linux kernel networking vulnerability, CVSS 9.3, that lets code inside a guest virtual machine read host memory, crash the host, and in lab conditions escape the VM with host administrator privileges.
Has PwnEscape been exploited in the wild?
No. The flaw was reported privately before public disclosure, and there is no sign of real-world exploitation. The memory leak was demonstrated against Vercel’s live sandboxes; the crash and code execution were lab-only results.
Which kernel versions fix PwnEscape?
Fixed stable versions include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, and 7.2.11, plus backports in many distribution kernels. Update the host kernel and reboot the host.
Does patching the guest VM fix PwnEscape?
No. The vulnerable code runs in the host kernel’s networking stack, so only a host kernel update and reboot mitigates the flaw. Guest-side patches and workarounds do not help.
Who discovered PwnEscape?
Paulos Yibelo of security firm pwn.ai, during Vercel’s $1 million Sandbox security challenge in August 2026. The team used an AI-assisted research harness called Omega-Pwn and found the bug in three days for under $700 in API tokens.