Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory

1. Executive summary

A critical flaw in the Linux kernel's networking code, tracked as CVE-2026-99999 and nicknamed PwnEscape, allows code running inside a guest virtual machine to read memory on the host that runs it. The bug sits in the kernel itself rather than in any single cloud provider's configuration, so it reaches the shared infrastructure underneath multi-tenant compute. A researcher demonstrated the leak against Vercel's live cloud sandboxes and Vercel confirmed it. CVE-2026-99999 carries a CVSS score of 9.3 (CRITICAL) and is not listed in CISA KEV, so there is no confirmed in-the-wild exploitation and no federal remediation deadline attached. For EMEA financial services, the exposure is concentrated in any workload that runs untrusted code on shared Linux hosts: CI/CD runners, serverless and sandbox platforms, and customer-facing code-execution features.

2. Regulatory framing

No NIS2 or UK NIS article is directly engaged by the facts available here. The item describes a disclosed vulnerability with a demonstrated proof of concept, not a confirmed incident affecting a client's own network and information systems, so the incident-reporting obligations in NIS2 Art. 23 and the UK NIS 2018 OES/RDSP duties are not triggered on the current evidence.

3. Technical analysis & attack chain

The source material for CVE-2026-99999 is thin. The primary item confirms the vulnerability class, the affected subsystem, the CVSS score, and the demonstration against a live platform, but it does not publish the vulnerable function, the kernel version range, a patch commit, or a proof-of-concept. The attack chain below is limited to what the source states.

1. An attacker obtains the ability to run code inside a guest virtual machine on a host running an affected Linux kernel.
2. The guest code triggers the flaw in the kernel's networking code.
3. The guest reads memory belonging to the host that runs it, crossing the isolation boundary that is supposed to separate the guest from the host.

The source does not describe write access, privilege escalation to host root, code execution on the host, persistence, command-and-control, lateral movement, or exfiltration. Read access to host memory is the confirmed impact. Whether that read can be chained into a full host compromise is not established by the material provided.

The affected component is the Linux kernel's networking code, which means the flaw is not specific to one cloud provider's deployment. Any environment that runs untrusted code on a shared Linux host is potentially in scope, including CI/CD runners, serverless and sandbox platforms, and any customer-facing feature that executes user-supplied code. The demonstration against Vercel's live cloud sandboxes, confirmed by Vercel, is the only named real-world target in the source.

Confidence caveats. The primary item is a single source and is truncated. The vulnerable kernel version range, the patch status, and the exact trigger conditions are not stated. Treat the scope as "Linux hosts running untrusted guest code" until the kernel maintainers or a distribution publish an advisory with version detail. The related sources in the corpus describe separate KVM and virtualization flaws (CVE-2026-89775, CVE-2026-74580, CVE-2026-53359, CVE-2026-64561) that share the guest-to-host escape theme but are distinct CVEs with distinct mechanisms. They are context for the class of bug, not evidence about CVE-2026-99999, and should not be conflated with it.

4. Mitigation & containment

The source does not name a vendor fix, a patch commit, or a workaround. The steps below follow from the confirmed facts and should be treated as interim until the kernel maintainers publish remediation guidance.

P1 (within 24 hours)

• Inventory every Linux host that runs untrusted guest code: CI/CD runners, sandbox and serverless platforms, and any customer-facing code-execution feature. This is the population exposed to CVE-2026-99999.
• Contact each third-party provider that hosts untrusted code on your behalf, including any sandbox or serverless vendor, and request their remediation status and timeline for CVE-2026-99999. The Vercel demonstration shows the exposure is real on live platforms.
• Where you control the host, restrict which workloads are permitted to run untrusted code on shared hosts until a patch is available. Move untrusted execution to dedicated, single-tenant hosts if that is operationally possible.

P2 (within 72 hours)

• Track the upstream Linux kernel advisory and your distribution's security tracker for CVE-2026-99999. Apply the kernel patch as soon as your distribution ships it, and reboot to load the new kernel.
• For hosts you cannot patch immediately, reduce the attack surface by disabling or restricting the networking features implicated by the flaw once the vulnerable function is identified. The source does not name the function, so this step depends on the upstream advisory.
• Review whether any workload that runs untrusted code also has access to sensitive data or credentials on the same host. If it does, separate them.

P3 (within 7 days)

• Add CVE-2026-99999 to your vulnerability management tracking with the CVSS 9.3 score and the not-in-KEV status, and re-check KEV status as exploitation intelligence develops.
• Confirm that your third-party providers have a documented process for disclosing and remediating kernel-level flaws affecting shared hosts, and that your contracts cover notification timelines. This is the DORA Art. 30 point above.

5. Indicators of compromise

No indicators of compromise available in the source material. The source names no hashes, domains, IP addresses, file paths, or command lines. The only named entity is Vercel, which is the platform used for the demonstration, not an indicator of compromise.

6. Detection

Insufficient indicators to author detection rules. The source provides no distinctive strings, command-line flags, file paths, registry keys, or behavioural artefacts specific to CVE-2026-99999. The related corpus sources describe different CVEs and cannot be used to build detection content for this one.

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

7. Sources

• The Hacker News, "Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory", https://thehackernews.com/2026/10/critical-pwnescape-linux-kernel.html, 2026-10-15.
• The Hacker News, "New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory", https://thehackernews.com/2026/09/new-linux-kernel-flaw-gives-arm64-kvm.html (context: CVE-2026-89775, separate flaw).
• The Hacker News, "AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host", https://thehackernews.com/2026/10/ai-found-linux-kernel-flaw-gives-local.html (context: CVE-2026-74580, separate flaw).
• SecurityWeek, "Linux Kernel Vulnerability Allows VM Escape on Intel and AMD Systems", https://www.securityweek.com/linux-kernel-vulnerability-allows-vm-escape-on-intel-and-amd-systems/ (context: CVE-2026-53359, separate flaw).
• The Hacker News, "16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems", https://thehackernews.com/2026/07/16-year-old-linux-kvm-flaw-lets-guest.html (context: CVE-2026-53359, separate flaw).
• BleepingComputer, "New Januscape Linux flaw allows VM escape on Intel, AMD devices", https://www.bleepingcomputer.com/news/linux/new-januscape-linux-kernel-flaw-allows-vm-escape-on-intel-amd-devices/ (context: CVE-2026-53359, separate flaw).
• The Hacker News, "New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts", https://thehackernews.com/2026/08/new-zapscape-kvm-flaw-could-let.html (context: CVE-2026-64561, separate flaw).

8. Adverse Trace position

Adverse Trace assesses CVE-2026-99999 as a critical-severity vulnerability (CVSS 9.3) with a confirmed guest-to-host memory read demonstrated against a live platform, but with no confirmed in-the-wild exploitation and no CISA KEV listing. The client impact is concentrated in workloads that run untrusted code on shared Linux hosts, and the primary dependency is the upstream kernel patch and each third-party provider's remediation timeline, neither of which is available in the source material. The technical detail is single-sourced and the primary item is truncated, so we are treating the version range and patch status as unknown until the kernel maintainers publish an advisory. We will track the upstream Linux kernel advisory and the distribution security trackers for CVE-2026-99999, re-check CISA KEV status, and issue a follow-up when a patch or exploitation evidence appears. Clients running untrusted code on third-party sandbox or serverless platforms should request remediation status from those providers now and treat the response as a DORA Art. 28 third-party risk input.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.