Cybersecurity
Linux kernel flaw lets guest VMs read host memory
A Linux kernel flaw let guest virtual machines read host memory, and a researcher showed it against Vercel's sandboxes while maintainers rated it critical and pushed a fix to stable branches.
- Paulos Yibelo of pwn.ai found the flaw during Vercel's August security challenge, and Vercel said it was disclosed privately before public release.
- The issue let code running inside a guest read host memory, and Yibelo said the same flaw could also crash a host and execute code on it in his own tests.
- The CVE record rated CVE-2026-99999 at 9.3 and marked the attack vector as local, and the article said no real-world use had been reported.
- Red Hat's Michael S. Tsirkin wrote the Linux kernel fix, which was merged into mainline and backported to stable branches.
- Vercel said the flaw came from a two-week challenge that paid $242,000 across 1,285 reports, and pwn.ai said it spent under $700 in API tokens.
The article said CVE-2026-99999 was a Linux kernel networking flaw that let code inside a virtual machine read memory from the host. Vercel said a researcher had shown the leak against its production sandboxes.
Paulos Yibelo said crafted packets sent from inside a guest could read host memory, crash the host and run code on it. Vercel said each packet could return about 32 bytes of memory, and that the crash and code execution were shown only on Yibelo's own test machines.
The published CVE record rated the issue 9.3 and described it as local, meaning an attacker had to already be running code inside a guest. The article said no real-world use had been reported, and that CISA did not list it among actively exploited vulnerabilities.
Vercel said its Sandbox used Firecracker microVMs on bare-metal Amazon EC2 hosts, and that the flaw was in the host Linux kernel rather than in Vercel's setup. The fix was a kernel change written by Red Hat's Michael S. Tsirkin, and maintainers backported it to stable branches.
Vercel said the issue had emerged from its August challenge, which offered up to $1 million in prizes and paid $242,000 across 1,285 reports. pwn.ai said it used an AI-assisted research system with GPT-5.6 Sol as its primary reasoning engine, together with human review.
Named in this story
People
- Paulos Yibelo
- the researcher who found and demonstrated the flaw
- Michael S. Tsirkin
- the Red Hat engineer who wrote the kernel fix
Companies
- Vercel
- ran the challenge and confirmed the memory leak
- pwn.ai
- the security firm that employed Yibelo
- Red Hat
- the company named as Michael S. Tsirkin's employer
Organisations
- SingularityNET
- the organisation named in pwn.ai's research harness
Governments and agencies
- U.S. National Vulnerability Database
- received the CVE entry and had not finished its review
- CISA
- did not list the flaw as actively exploited
Products and systems
- Linux kernel
- the software layer with the networking flaw
- Vercel Sandbox
- the sandbox environment used in the demonstration
- Firecracker
- the microVM layer Vercel used for its sandboxes
- Amazon EC2
- the bare-metal host platform for the sandboxes
- GPT-5.6 Sol
- the model pwn.ai said it used as its main reasoning engine
How the source tells it
The piece was a plain technical security report with no distinct emotive framing.
No emotive framing was found in the original.