Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory

A critical vulnerability in the Linux kernel, tracked as CVE-2026-99999 and nicknamed PwnEscape, allows guest virtual machines to read host memory, crash the host, and potentially execute code on it. The flaw resides in the kernel's networking code and was demonstrated against Vercel's production sandboxes, where specially crafted network packets from a guest VM could exfiltrate up to 32 bytes of host memory per packet. Although the vulnerability has not been exploited in the wild, it poses a broad risk to cloud providers using shared Linux kernel infrastructure, as it enables VM escape and host-level compromise.

AI-extracted · verify before operational use