Security researchers from Pwn.ai discovered a critical flaw in the Linux kernel’s networking stack, allowing attackers to escape KVM virtual machines and execute code on the host system. The vulnerability, dubbed PwnEscape and tracked as CVE-2026-99999, was found during a hacking challenge against Vercel’s sandbox platform.
The vulnerability or weakness
The vulnerability exploits checksum offloading in the Linux kernel’s networking code, enabling attackers to alter IPv4 headers after they are validated by the host’s kernel. This leads to potential memory leakage and code execution on the host system.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-99999 | 9.3 | CRITICAL | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
Organizations running Linux-based virtualization and sandbox platforms are at risk. While no reports of customer data breaches were confirmed by Vercel, the vulnerability could compromise sensitive information and operations.
Industries affected
The incident affects cloud service providers, IT companies, and any organization using KVM-based virtual machines for security or performance.
Users affected
Users of Vercel’s sandbox platform and other organizations running KVM-based virtual machines are advised to update their kernel versions to mitigate the risk. Not stated in the sources.
