Critical Linux Kernel Flaw Lets VM Guests Read Host Memory
Summary
CVE-2026-99999 lets code in a Linux guest VM read host memory. Researchers demonstrated the leak in Vercel production sandboxes; host crashes and code execution were shown only in a lab. A kernel fix is available, with no real-world exploitation reported.
Key points
- PwnEscape (CVE-2026-99999) affects Linux kernel networking code and is rated Critical, 9.3 out of 10.
- An attacker must already be able to run code inside a guest VM; the flaw is not remotely exploitable from the open internet.
- A researcher demonstrated host-memory disclosure in Vercel production sandboxes, with about 32 bytes returned per packet. Vercel said no customer files, secrets, or application data were shown to have been read.
- Host crashes and code execution, including administrator control, were demonstrated only on the researcher's own systems—not in a vendor's production environment.
- No real-world exploitation has been reported, and the flaw is not listed in CISA's catalog of actively exploited vulnerabilities.
- A Linux kernel fix has been merged and backported to stable branches. Administrators should check their distribution's advisory and update and reboot the host kernel; updating only a guest kernel does not fix the host.
- Vercel said it disables nested virtualization and uses Firecracker's jailer as additional containment; these measures do not fix the kernel flaw.
Article Details
- Vulnerability Types
- Linux kernel networking flaw allowing a guest virtual machine to read host memory, crash the host, and execute code on it
- Severity
- Critical; rated 9.3 out of 10 in the published record
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- No separate workaround is provided. While patching is delayed, Vercel says it limits potential impact by disabling nested virtualization and running each microVM under Firecracker's jailer.
MITRE ATT&CK
CVE
People
Vendors
Products
AWS EC2own Firecracker microVM, a small virtual machine with its own copy of the Linux kernel, on bare-metal Amazon EC2 hosts. That microVM is the wall between one customer and the host, and between one customer and another.FirecrackerVercel Sandbox runs each customer's code in its own Firecracker microVM, a small virtual machine with its own copy of the Linux kernel, on bare-metal Amazon EC2 hosts. That microVM is the wall between one customer andLinux kernelA newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, andVercel SandboxVercel Sandbox runs each customer's code in its own Firecracker microVM, a small virtual machine with its own copy of the Linux kernel, on bare-metal Amazon EC2 hosts. That microVM is the wall between one customer and
Tools
Omega-Pwn"Our research ran through Omega-Pwn, an internal harness combining our own security research tooling with elements of SingularityNET's OmegaClaw architecture. It let us carry hypotheses, code traces, failed attempts,OmegaClawan internal harness combining our own security research tooling with elements of SingularityNET's OmegaClaw architecture. It let us carry hypotheses, code traces, failed attempts, and experimental results across