CVE-2026-99999 “PWNESCAPE” — CVSS 9.3 CRITICAL — OCT 2026

Cybersecurity news: CVE-2026-99999 checker — can a virtual machine read your host's memory?

Cybersecurity news: a researcher just proved it: PwnEscape, a flaw in the Linux kernel's networking code, lets specially crafted packets sent from inside a guest VM read the host computer's memory — about 32 bytes per packet, for as long as the attacker keeps sending. In lab conditions the same flaw crashed the host with two packets and broke out to administrator control. It was demonstrated against Vercel's live production sandboxes, and Vercel confirmed it. Found in 3 days with AI-assisted research costing under $700 in API tokens. This free CVE check tool tells you if your host kernel is patched. No signup, nothing installed.

Update — October 17: attribution and distro patches

Discovered by Paulos Yibelo of pwn.ai during Vercel's $1M Sandbox challenge (Aug 18 – Sep 1) — the only critical finding among 1,285 reports. Vercel confirmed the memory leak on its live production sandboxes; no customer data was accessed.
Fix merged to mainline Oct 14, 2026 (commit 6785011f8b16) and backported to all affected stable branches — but some distributions haven't shipped it to users yet.
AlmaLinux 8, 9 and 10 are affected — patched kernels are in the testing repository now, awaiting verification before production release. If you run AlmaLinux as a VM host for anyone you don't fully trust, track the testing repo.
No in-the-wild exploitation reported. The root-code-execution chain was demonstrated on the researcher's own lab machines matching Vercel's config — not on production.

Is your kernel exposed to PwnEscape?

Direct answer: if your hosts run an unpatched Linux kernel with the vulnerable networking code and you allow untrusted guest VMs, assume yes until you check. The flaw reads about 32 bytes of host memory per crafted packet. Run the 30-second check below against your kernel version.

Get your HOST kernel version — on the host machine itself (patching the guest does not fix the host):

uname -r

Paste it below — e.g. 6.8.0-52-generic or 5.15.0-130-generic:

Important caveat: Linux distributions often backport security fixes without changing the version number — so a version below the fixed number may still be patched if your distro backported it. Always confirm against your distribution's security advisory (e.g. Debian security tracker, Ubuntu CVE tracker, RHEL errata), not just the number.

First fixed versions per stable branch

Stable branch	First fixed version
5.10	5.10.272
5.15	5.15.223
6.1	6.1.190
6.6	6.6.159
6.12	6.12.113
6.18	6.18.57
7.2	7.2.11

Source: the CVE-2026-99999 record. The flaw was introduced in kernel 2.6.27, so every supported branch was affected. Fix: upstream commit 6785011f8b16 ("ipv4: validate checksum_start before completing checksum") by Red Hat's Michael S. Tsirkin — a deliberately partial defense-in-depth check; fuller input validation is still forthcoming.

If you're exposed, do this now

Update the HOST kernel to a fixed version (or your vendor's build containing the fix) and reboot into it. Updating only guests changes nothing.
There is no workaround if you can't patch yet — but you can narrow the blast radius the way Vercel does: keep host kernels current, disable nested virtualization, and run each microVM under a least-privilege jailer (Firecracker's jailer model).
Who's actually at risk: clouds and platforms running untrusted tenant code in VMs on shared hosts. A single-purpose server with no untrusted guests is far less exposed — the attack needs code execution inside a guest first, and no in-the-wild exploitation has been reported.

Why this cybersecurity news matters beyond one cloud

It's in the shared layer, not one vendor's setup: the bug is in the Linux kernel's networking code that the host runs — the same layer almost every large cloud uses to separate customers' workloads. Vercel's sandbox was reportedly hardened beyond industry standards with no misconfiguration found.
A new attack class: per the researchers, untrusted checksum metadata can rewrite security-sensitive packet fields after the kernel validated them — undermining assumptions across the networking stack, far beyond this one VM escape.
The AI-accelerated discovery era: found in 3 days for under $700 in tokens, after another team used AI help to reach OpenAI's internal systems earlier this year. Kernel bug-hunting just got dramatically cheaper — defenders and attackers alike.
Found the right way: via Vercel's $1M sandbox-escape challenge (August, two weeks, 1,285 reports, $242,000 paid) — disclosed privately, coordinated across the industry before publication.

Track infrastructure-level threats like PwnEscape → BreachHunter

This page checked one CVE. BreachHunter hunts attacker infrastructure and compromise indicators — including the cloud-isolation flaws that turn one breached container into a breached host.

FROM INGENIOUS AI

Ingenious AI builds 11 AI security platforms — disclosure compliance, rogue-agent defense, breach hunting, agent oversight, and more.

All 11 platforms: DisclosureGuard · ModelMinder · TermsWatch · Vibe-Code Audit · Rogue-Agent Defense · BreachHunter · ChatBreaker · Agent Flight Recorder · Agent Auth Gateway · DomainGuard · ContentCraft AI

Our platforms are being upgraded and return November 1 — get early access now:

Get early access on WhatsApp →

What is PwnEscape CVE-2026-99999?

PwnEscape (CVE-2026-99999, CVSS 9.3 Critical) is a Linux kernel networking flaw: specially crafted packets sent from inside a guest virtual machine can read the host computer's memory, crash the host, and — in lab conditions — run code on it, breaking out of the VM. It was demonstrated against Vercel's live cloud sandboxes, which Vercel confirmed.

How do I check if my host kernel is patched against PwnEscape?

Run 'uname -r' on the HOST (not the guest — patching the guest does not fix the host). Compare against the first fixed versions per stable branch: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, 7.2.11. Because distributions often backport fixes without changing the version number, also check your distribution's security advisory. The interactive checker on this page does the comparison for you.

Can PwnEscape be exploited remotely over the internet?

No. The attack vector is local — the attacker must already be running code inside a guest VM on the target host. It is not in CISA's Known Exploited Vulnerabilities catalog and no in-the-wild exploitation has been reported. The risk is to shared/cloud infrastructure where untrusted tenants run code, not to a typical single-purpose server.

What is a CVE checker?

A CVE checker is a free tool that tells you whether your software is affected by a published CVE — a publicly known cybersecurity vulnerability. It compares your version or configuration against the official advisory and gives you a patched, vulnerable, or unknown verdict in about 30 seconds.

How do I check if my software has a CVE?

Find your exact version number, then compare it against the vendor's security advisory or the NVD entry for the CVE. The fastest way is a CVE checker built for that product: paste your version and get an instant verdict against the published version tables.

How do I know if I am affected by a CVE?

You are affected when you run a vulnerable version and the vulnerable component is reachable or enabled — for example, open sign-ups, an exposed management port, or a vulnerable app installed. A CVE checker gives you the version verdict in seconds; the advisory's conditions tell you whether that verdict means real exposure.