Critical Linux Kernel Flaw 'PwnEscape' Lets Guest VMs Read Host Memory on Cloud Sandboxes

Security researcher Paulos Yibelo of pwn.ai discovered a critical Linux kernel networking vulnerability tracked as CVE-2026-99999 (dubbed PwnEscape) and rated 9.3 out of 10 by kernel maintainers, demonstrating that a guest virtual machine could leak roughly 32 bytes of host memory per crafted packet against Vercel's live production sandboxes. Using an internal AI-assisted research harness called Omega-Pwn with GPT-5.6 Sol as the primary reasoning engine, pwn.ai identified the flaw in three days at a cost of under $700 in API tokens during a two-week Vercel security challenge in August that paid $242,000 across 1,285 reports, with a top single payout of $50,000. On local lab machines configured to match Vercel's environment, two specially crafted packets crashed the host and took down every sandbox on it, while further exploitation achieved administrator control of the host; Yibelo stressed that the crash and code execution were strictly lab results rather than production root execution. Because the flaw resides in the host Linux kernel's networking stack rather than Vercel's hardened Firecracker microVMs on bare-metal Amazon EC2 hosts, it affects the shared isolation layer used across major cloud providers, though Vercel confirmed no customer files, secrets, or application data were accessed and no real-world exploitation has been reported. Red Hat's Michael S. Tsirkin authored mainline kernel fix commit 6785011f8b16—described as a partial defense-in-depth measure that checks IPv4 header checksum pointers in five places—which has been backported to stable branches and requires a host kernel update and reboot, as no standalone workaround exists. "Our research ran through Omega-Pwn, an internal harness combining our own security research tooling with elements of SingularityNET's OmegaClaw architecture. It let us carry hypotheses, code traces, failed attempts, and experimental results across long-running research sessions. GPT-5.6 Sol was the primary reasoning engine. We directed the investigation, challenged its findings, and validated the interesting ones against actual kernel behavior on systems we controlled." — Paulos Yibelo