CYBERSECURITYTRACKER
Permanent story citation

Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 10427

As cited

Copy frozen at (site build).

vulnerabilities

Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory

A critical flaw in the Linux kernel, tracked as CVE-2026-99999 with a CVSS score of 9.3, allows guest virtual machines to read memory on the host system. A researcher demonstrated the vulnerability against Vercel's cloud sandboxes, and Vercel confirmed the issue. The vulnerability exists in the kernel's networking code, affecting multiple cloud platforms.

Why it matters: Cloud providers, hosting companies, and their customers face immediate risk of cross-VM data exposure; kernel patching and isolation validation are urgent priorities.

VendorsLinux
Source published
First seen by Cybersecurity Tracker

Source attribution

Correction

Correction recorded as of .

vulnerabilities

Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory

A critical flaw in the Linux kernel, tracked as CVE-2026-99999 with a CVSS score of 9.3, allows guest virtual machines to read memory on the host system. A researcher demonstrated the vulnerability against Vercel's cloud sandboxes, and Vercel confirmed the issue. The vulnerability exists in the kernel's networking code, affecting multiple cloud platforms.

Why it matters: Cloud providers, hosting companies, and their customers face immediate risk of cross-VM data exposure; kernel patching and isolation validation are urgent priorities.

VendorsLinux
Source published
First seen by Cybersecurity Tracker

Source attribution

Correction

Correction recorded as of .

vulnerabilities

Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory

A critical flaw in the Linux kernel, tracked as CVE-2026-99999 with a CVSS score of 9.3, allows guest virtual machines to read memory on the host system. A researcher demonstrated the vulnerability against Vercel's cloud sandboxes, and Vercel confirmed the issue. The vulnerability exists in the kernel's networking code, affecting multiple cloud platforms.

Why it matters: Cloud providers, hosting companies, and their customers face immediate risk of cross-VM data exposure; kernel patching and isolation validation are urgent priorities.

VendorsLinux
Source published
First seen by Cybersecurity Tracker

Source attribution

Correction

Correction recorded as of .

vulnerabilities

Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory

A critical flaw in the Linux kernel, tracked as CVE-2026-99999 with a CVSS score of 9.3, allows guest virtual machines to read memory on the host system. A researcher demonstrated the vulnerability against Vercel's cloud sandboxes, and Vercel confirmed the issue. The vulnerability exists in the kernel's networking code, affecting multiple cloud platforms.

Why it matters: Cloud providers, hosting companies, and their customers face immediate risk of cross-VM data exposure; kernel patching and isolation validation are urgent priorities.

VendorsAmazon Web ServicesGoogleLinux
Source published
First seen by Cybersecurity Tracker

Source attribution

Correction

Correction recorded as of .

vulnerabilities

Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory

A critical Linux kernel flaw tracked as CVE-2026-99999 allows guest virtual machines to read memory from the host system. A researcher demonstrated the vulnerability against Vercel's cloud sandboxes, and Vercel confirmed the issue. The flaw resides in the kernel's networking code rather than cloud-specific configurations.

Why it matters: Cloud providers and enterprises running virtualized workloads face potential data exposure from untrusted guest VMs, requiring immediate patching and investigation of whether the vulnerability has been exploited in production environments.

VendorsAmazon Web ServicesGoogleLinux
Source published
First seen by Cybersecurity Tracker

Source attribution

Correction

Correction recorded as of .

vulnerabilities

Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory

A critical Linux kernel vulnerability tracked as CVE-2026-99999 allows guest virtual machines to read memory on the host system. The flaw, dubbed PwnEscape, resides in the kernel's networking code and was demonstrated against Vercel's cloud sandboxes, which Vercel has confirmed.

Why it matters: Cloud providers and organizations running Linux hosts with virtual machines face immediate risk of guest-to-host memory disclosure; patching the kernel is required to prevent data exposure across security boundaries.

VendorsAmazon Web ServicesGoogleLinux
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary