Security researchers have found a critical flaw in the Linux kernel’s networking stack that can let attackers escape a KVM virtual machine and execute code on the host system. The weakness could also potentially let attackers compromise systems running other Linux-based virtualization and sandbox platforms.
Tracked as CVE-2026-99999 and dubbed PwnEscape, the vulnerability was discovered by researchers from AI-powered pentesting startup Pwn.ai during a $1 million challenge to hack Vercel’s sandbox platform, which uses KVM-based Firecracker microVMs. Rather than exploiting a bug in the KVM hypervisor itself, the attack targets the Linux networking code that handles traffic from inside virtual machines. Specially crafted packets can alter an IPv4 header after the host’s kernel has already validated it, causing later processing to trust packet data that attackers have manipulated.
The Pwn.ai researchers demonstrated host-memory leakage against Vercel’s production sandboxes and separately achieved host crashes and root-level code execution on researcher-controlled systems. Vercel confirmed the findings but said no reports showed access to customer files, secrets, or application data.
A fix was merged into the mainline Linux kernel with patched kernel versions now available for multiple distributions. Administrators need to deploy those kernel updates on host systems because updating only guest VMs does not fix the vulnerability.
The flaw involves checksum off, a performance optimization that allows Linux to postpone calculating a packet’s checksum. Alongside the packet, the kernel carries metadata specifying where that calculation should begin and where its result should be written, but in virtual networking those instructions can originate from an untrusted guest.
The vulnerable implementation failed to ensure that completing the checksum would leave the already-validated IPv4 header untouched, meaning that guest-controlled metadata could directly write into that header, changing the advertised length before the packet was split into smaller fragments for transmission.
In their demonstration, the researchers managed to change the header length from 20 to 60 bytes, while the packet buffer held only 28 bytes of valid data. The fragmentation process then copied 32 bytes beyond that valid data into outgoing packets, leaking host memory. By repeating the process, the researchers were able to make observations and control memory allocations to achieve host-kernel memory writes to run a helper program as root. The complete exploitation steps that take this attack from a memory leak to code execution have not been publicly revealed yet, but the researchers plan a separate write-up.
“The allocator-sensitive write chain, object-lifetime controls, and other hypervisor-specific adaptation are large enough to require a separate article,” they said. “Although we suspect the security industry will use this post to figure out the other affected hypervisors and we expect exploits in weaker configurations to arrive in weeks, and exploits working in default hypervisor configurations to arrive in under a month.”
PwnEscape differs from other VM escape attacks that target the hypervisor’s handling of virtual CPUs or memory. The Januscape vulnerability disclosed earlier this year, for example, affected KVM’s memory-management code, but with this exploit the vulnerable code is in the Linux host’s IPv4 networking subsystem.
The researchers warn that similar bugs could exist elsewhere in the networking stack, wherever guest-controlled metadata can modify packet fields after those fields have already passed validation.
The accepted patch, authored by Red Hat developer Michael S. Tsirkin, adds validation at five checksum completion points, including IPv4 fragmentation, bridge connection tracking, and packet filtering, but the patch commit message states that “a more complete validation at input is forthcoming, but needs more work.”
The flaw’s impact for other hypervisors and container technologies remains to be seen. Red Hat lists OpenShift Container Platform components as affected, but other virtualization technologies like Docker or Xen have not issued advisories yet.
The guest-to-host attack requires an attacker-controlled workload capable of supplying the malformed traffic through the virtual network. As a result, admins of environments that allow the execution of untrusted code inside VMs need to take action as soon as possible.
“A VM escape is another kernel vulnerability because KVM lives inside the Linux kernel, but it has more serious implications,” Alex Zenla, CTO and co-founder of container security firm Edera, told CSO. “When a guest breaks out, it isn’t escaping into some neatly contained hypervisor; it can land in the lowest levels of the operating system that owns the host’s processes, drivers, and network stack. This is critical and a very different security proposition from a hypervisor designed with a deliberately tiny privileged layer.”
KVM and other kernel-based virtualization components have had multiple critical vulnerabilities this year, some of them found with the help of LLMs, including PwnEscape. Meanwhile AI agents have been observed attempting to break out of sandboxes during tests. This challenges the workload isolation assumptions in virtualized environments.
“Security architecture has to assume that eventually, something will be compromised and make sure that compromise doesn’t become total host ownership,” Zenla said.
AWS says its managed EC2, Lambda, and Fargate services are unaffected by CVE-2026-99999, but customers running their own KVM virtual machines with virtio-net networking on vulnerable hosts need to apply the relevant kernel updates. Administrators should follow their distribution’s advisories because the fixes can be backported to older kernel versions.