PwnEscape lets Linux guests expose host memory through a kernel networking flaw
Cyber Security · Monday, October 19, 2026 · 4 sources

PwnEscape lets Linux guests expose host memory through a kernel networking flaw

Researchers at pwn.ai say CVE-2026-99999 lets guest-provided checksum metadata overwrite an IPv4 header that the Linux host has already checked, leading to a repeatable 32-byte host-memory disclosure. Pwn.ai demonstrated host code execution on its own KVM setup, while SevyDevy reports a production memory leak in Vercel sandboxes but no production host takeover. Linux merged a fix that checks checksum positions before completion in five IPv4 processing paths.

Bottom line — The upstream fix is merged; Linux hosts running untrusted guests need a patched kernel to close the 32-byte disclosure path.

Go deeper 5

  1. Pwn.ai traced the flaw to deferred checksum processing in the Linux networking stack, not to a Vercel-specific configuration.

  2. The 32-byte disclosure was demonstrated in controlled tests; pwn.ai says its separate host-execution chain required additional memory manipulation.

  3. SevyDevy says Vercel reported no evidence of customer-data access in its sandbox.

  4. Linux merged the guard on 14 October 2026, according to pwn.ai; the patch is described as defence in depth, not a complete redesign of checksum validation.

  5. The Linux CNA rated the flaw 9.3 on CVSS, while Red Hat assigned 8.8, according to DEV Community.

Read the reporting 4

dstld. Your daily news summary designed to surface the news that matters from a European perspective. Curated by humans, summarized by AI - always with links back to the original reporting.

Links · Contact
Popular topics · WorldEuropeGamesAI
Last generated: Oct 19, 6:08 PM UTC by wreetco

dstld. Your daily news summary designed to surface the news that matters from a European perspective. Curated by humans, summarized by AI - always with links back to the original reporting.

Links · Contact
Popular topics · WorldEuropeGamesAI
Last generated: Oct 19, 6:08 PM UTC by wreetco