The Linux kernel eliminated the critical vulnerability of PwnEscape, which allows you to get out of the virtual machine and gain control over the physical server. The 9.3-point score error on CVSS threatened cloud platforms where different customers use shared infrastructure.
The PwnEscape vulnerability has received the CVE-2026-99999 identifier and affects the Linux network stack, not the KVM virtualization mechanism itself. Researcher Paulos Yibelo of pwn.ai demonstrated three scenarios of the attack. An attacker can read the memory of a physical server, call it emergency work completion or achieve the execution of commands with root rights. For an attack, specially formed network packages from the guest system are sufficient.
The most dangerous scenario allows you to disturb the isolation between virtual machines and the server on which other applications work. Having obtained administrative rights on the host, the attacker will potentially be able to reach the data of other customers and interfere with the work of the common infrastructure. The cloud services, VPS hosting, automatic assembly environments, malware analysis tools and sandboxes for running untrusted code are threatened.
The scale of the problem was confirmed by Vercel specialists. During the security check, the researcher managed to extract fragments of the memory of the real servers of the cloud platform through the working virtual machines. One specially prepared package allowed you to get about 32 bytes, and the operation could be repeated. The attack opened the possibility of gradually collecting information from the host's memory, not available to the guest system.
The more serious consequences of Yibelo confirmed in his own laboratory. Two defined network packages were enough for the emergency completion of the host, and further operation allowed the execution of commands with root rights. The researcher played an attack on systems with KVM and Firecracker, including four successful runnings of the administrative access chain after a complete reboot of the test server. The execution of arbitrary code on Vercel production servers was not demonstrated.
The reason for the vulnerability was the unexpected interaction of conventional IPv4 processing mechanisms. The Linux kernel first checked the network package header, but then when calculating the checksum could change the already verified fields. Specially prepared service data allowed to replace the specified length of the IP header from 20 to 60 bytes. In subsequent processing, the system took additional bytes of memory for part of the package and could send them over the network.
The peculiarity of PwnEscape is that for the initial leak it was not necessary to hack the hypervisor itself, which controls the virtual machines. The attacker acted on the network functions of the main operating system, available through a virtual network interface. According to the author of the study, the problem shows a whole class of potential attacks, in which the program changes the data after the security check, and the other components continue to trust the result.
The developers of Linux confirmed the vulnerability on October 15 and gave it a critical score of 9.3 points. The error was present in the code starting with Linux 2.6.27. Corrections are included in the kernel version 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, 7.2.11 and 7.3-rc7. The defense prohibits the completion of the calculation of the checksum if the service parameters allow you to overwrite the IPv4 title. The developers also prepare additional checks of packages upon admission to the network stack.
Distribution providers have started to prepare updates. On October 16, AlmaLinux released corrected test kernel builds for versions 8, 9 and 10. Red Hat confirmed the impact of the error on its products, but rated the danger slightly lower, at 8.8 on CVSS. Server administrators with virtual machines are advised to install corrected versions of the kernel through regular distribution updates. The confirmed attacks of intruders using PwnEscape were not publicly reported.
The vulnerability was discovered during a competition that Vercel launched on August 18 with a total prize pool of up to $1 million. Yibelo sent the initial report on August 20, and in September passed the information to the developers of the Linux kernel. When searching for errors, the researcher used the Omega-Pwn experimental system, combining automated tools and language models for source code analysis. The main work on the selection of the research directions and verification of the results was performed by the person.
For PwnEscape, the researcher received the maximum award of 50 000 dollars. In two weeks, the organizers received 1285 reports and paid participants 242 000 dollars, and only one find was critical. Vercel said none of the reports showed access to client data. The company also engaged other cloud market participants to fix the problem, as the error was in the common code of Linux and did not depend on the settings of a particular provider.
In 2026, researchers have already found similar ways out of virtual machines. The ITScape vulnerability allowed the host to be captured with KVM on the arm64 architecture, and Januscape affected other virtualization mechanisms. However, previous attacks relied on the specific features of the hypervisor or its configuration. PwnEscape stands out for using the overall Linux network subsystem, so the potential range of vulnerable environments is much wider.
The PwnEscape vulnerability has received the CVE-2026-99999 identifier and affects the Linux network stack, not the KVM virtualization mechanism itself. Researcher Paulos Yibelo of pwn.ai demonstrated three scenarios of the attack. An attacker can read the memory of a physical server, call it emergency work completion or achieve the execution of commands with root rights. For an attack, specially formed network packages from the guest system are sufficient.
The most dangerous scenario allows you to disturb the isolation between virtual machines and the server on which other applications work. Having obtained administrative rights on the host, the attacker will potentially be able to reach the data of other customers and interfere with the work of the common infrastructure. The cloud services, VPS hosting, automatic assembly environments, malware analysis tools and sandboxes for running untrusted code are threatened.
The scale of the problem was confirmed by Vercel specialists. During the security check, the researcher managed to extract fragments of the memory of the real servers of the cloud platform through the working virtual machines. One specially prepared package allowed you to get about 32 bytes, and the operation could be repeated. The attack opened the possibility of gradually collecting information from the host's memory, not available to the guest system.
The more serious consequences of Yibelo confirmed in his own laboratory. Two defined network packages were enough for the emergency completion of the host, and further operation allowed the execution of commands with root rights. The researcher played an attack on systems with KVM and Firecracker, including four successful runnings of the administrative access chain after a complete reboot of the test server. The execution of arbitrary code on Vercel production servers was not demonstrated.
The reason for the vulnerability was the unexpected interaction of conventional IPv4 processing mechanisms. The Linux kernel first checked the network package header, but then when calculating the checksum could change the already verified fields. Specially prepared service data allowed to replace the specified length of the IP header from 20 to 60 bytes. In subsequent processing, the system took additional bytes of memory for part of the package and could send them over the network.
The peculiarity of PwnEscape is that for the initial leak it was not necessary to hack the hypervisor itself, which controls the virtual machines. The attacker acted on the network functions of the main operating system, available through a virtual network interface. According to the author of the study, the problem shows a whole class of potential attacks, in which the program changes the data after the security check, and the other components continue to trust the result.
The developers of Linux confirmed the vulnerability on October 15 and gave it a critical score of 9.3 points. The error was present in the code starting with Linux 2.6.27. Corrections are included in the kernel version 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, 7.2.11 and 7.3-rc7. The defense prohibits the completion of the calculation of the checksum if the service parameters allow you to overwrite the IPv4 title. The developers also prepare additional checks of packages upon admission to the network stack.
Distribution providers have started to prepare updates. On October 16, AlmaLinux released corrected test kernel builds for versions 8, 9 and 10. Red Hat confirmed the impact of the error on its products, but rated the danger slightly lower, at 8.8 on CVSS. Server administrators with virtual machines are advised to install corrected versions of the kernel through regular distribution updates. The confirmed attacks of intruders using PwnEscape were not publicly reported.
The vulnerability was discovered during a competition that Vercel launched on August 18 with a total prize pool of up to $1 million. Yibelo sent the initial report on August 20, and in September passed the information to the developers of the Linux kernel. When searching for errors, the researcher used the Omega-Pwn experimental system, combining automated tools and language models for source code analysis. The main work on the selection of the research directions and verification of the results was performed by the person.
For PwnEscape, the researcher received the maximum award of 50 000 dollars. In two weeks, the organizers received 1285 reports and paid participants 242 000 dollars, and only one find was critical. Vercel said none of the reports showed access to client data. The company also engaged other cloud market participants to fix the problem, as the error was in the common code of Linux and did not depend on the settings of a particular provider.
In 2026, researchers have already found similar ways out of virtual machines. The ITScape vulnerability allowed the host to be captured with KVM on the arm64 architecture, and Januscape affected other virtualization mechanisms. However, previous attacks relied on the specific features of the hypervisor or its configuration. PwnEscape stands out for using the overall Linux network subsystem, so the potential range of vulnerable environments is much wider.
