Critical Linux Kernel Flaw Lets Attackers Escape Virtual Machines and Take Control of Hosts

A critical flaw in the Linux kernel may allow an attacker-controlled virtual machine (VM) to breach its isolation boundary and impact the host system. This vulnerability, identified as CVE-2026-99999 and referred to as PwnEscape by researcher Paulos Yibelo, originates from the Linux networking code rather than a specific hypervisor.

Paulos Yibelo demonstrated a technique that exposes host memory and, in their lab, progressed to host-level code execution. The flaw is serious for cloud providers and organizations that run untrusted workloads in virtual machines. VM isolation is meant to stop code inside one guest from reaching the host and other workloads.

PwnEscape shows how a weakness in a host’s packet-processing path can threaten that boundary, even when the underlying issue is not in the hypervisor itself.

PwnEscape Kernel Vulnerability

Linux can delay calculating a network packet’s checksum. This is a normal performance feature: packet metadata tells the kernel where the checksum operation should begin and where the result should be written.

According to Paulos Yibelo’s PwnEscape report, the problem occurred when less-trusted packet metadata could influence a later write into an IPv4 header. Linux had already processed the packet using the header’s earlier contents. But before fragmentation, the deferred checksum operation could change those contents. Later code then relied on the updated IPv4 header length.

In Paulos Yibelo’s test case, the packet initially appeared to have a standard 20-byte IPv4 header. After the deferred write, the header could be interpreted as 60 bytes long. The fragmentation code could then treat bytes beyond the packet’s valid linear data as part of the header and include them in an outgoing packet. He reported that this exposed 32 bytes of host memory.

That disclosure is not the same as code execution. The report describes a separate, controlled lab chain in which researchers used host-memory observations and carefully managed allocation behavior to demonstrate selected kernel-memory writes and run a host-root helper. They say this result was reproduced on researcher-owned systems, not as proof of root execution in a cloud provider’s production environment.

The distinction matters for readers assessing the risk. A host-memory leak can reveal information that should remain outside a guest’s reach. Further steps may be needed to turn that primitive into control of the host, and the report does not establish that every Linux VM or hypervisor is equally vulnerable.

The upstream Linux patch adds a check before certain checksum-completion operations. It verifies that the checksum start is not inside the IPv4 header. If the metadata fails the check, the kernel does not proceed with that checksum write along the affected path. The change covers several consumers, including IPv4 fragmentation.

The commit describes the change as a defense-in-depth measure. It also notes that stronger validation at packet input needs more work. In other words, the patch adds protection at places where the kernel completes checksums, but it is not presented as a full redesign of how all checksum metadata enters the networking stack.

Administrators should review their Linux vendor’s security notices and install an updated kernel that includes the fix. The upstream commit can help identify the change, but Linux distributions may backport security fixes to older kernel versions. A version number alone may not show whether a system is protected, so check the vendor’s advisory and confirm that the system is running the updated kernel.

PwnEscape reminds us that VM security depends on more than the hypervisor. Guest traffic also passes through host operating-system components, including networking code. When metadata can trigger a write later in packet processing, checks made earlier may no longer describe the packet that a later component sees.

The discovery emerged from Vercel’s $1 million Sandbox security challenge, which invited researchers to test its isolation controls. Paulos Yibelo of pwn.ai reported the Linux kernel flaw on the third day while working from a standard sandbox without special access. Vercel called it the program’s most important finding.

The challenge received 1,285 reports over two weeks and paid $242,000 in total bounties, with the kernel flaw accounting for its only critical-rated finding.

Cybersecurity News has also covered Vercel’s confirmation of a KVM escape report and a separate Linux vhost flaw with a public proof of concept. These are distinct issues with different causes. They should not be treated as interchangeable or assumed to be fixed by the same patch.

For defenders, the immediate step is to track vendor updates and patch Linux hosts that run virtual machines. The underlying failure was a mismatch between packet metadata and the IPv4 header that later code trusted. That makes the fix important not only for virtualization providers but also for teams that depend on Linux network processing to keep untrusted workloads contained.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.