Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory

What happened?

A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it. The flaw, now tracked as CVE-2026-99999 and nicknamed PwnEscape, is in the Linux kernel's networking code, not in any one cloud's setup, so it reaches the shared

Key details

• Attacker must already have code running inside a guest VM to exploit the flaw.
• Flaw allows host crash and code execution with two specially crafted packets.
• Researcher demonstrated breaking out of VM to gain administrator control of host.

Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.