18.09.2024
2 min
1377
A critical vulnerability known as PwnEscape has been discovered in the Linux kernel, allowing attackers to bypass virtual machine isolation and gain access to the host server’s memory. The flaw received a severity score of 9.3 out of 10, and a security researcher has already demonstrated the possibility of completely compromising the host system.
The vulnerability has been assigned the identifier CVE-2026-99999 and named PwnEscape. It was discovered by security researcher Paulos Yibelo, who demonstrated the ability to escape a KVM virtual machine and compromise the underlying host server.
What makes this vulnerability particularly significant is that it affects the Linux kernel’s networking stack rather than KVM virtualization technology itself. As a result, various virtualization environments that rely on vulnerable Linux networking functionality could potentially be at risk.
To exploit the vulnerability, an attacker only needs to send specially crafted IPv4 network packets from inside a virtual machine. The attack does not require elevated privileges or user interaction, and its complexity is rated as low. However, the attacker must already have the ability to execute code within the guest environment, meaning this is not a conventional remote attack carried out directly over the internet.
In a post on X, Yibelo explained that PwnEscape enables virtual machine escapes across multiple hypervisors due to a flaw in the Linux networking stack.
The vulnerability poses a particular threat to cloud platforms, where multiple customers’ virtual machines often run on the same physical server. A successful attack could potentially allow an attacker to break out of their isolated environment and gain control of the host, putting other systems running on that server at risk.
In his technical report, the researcher explained that the flaw occurs during the processing of network packet checksums. When a virtual machine transmits data over a network, the host server’s kernel may calculate a checksum itself to verify the integrity of the transmitted information.
This process uses a mechanism known as deferred checksum calculation and a kernel function called skb_checksum_help. The virtual machine supplies metadata specifying where the checksum should be calculated and where the result should be written. However, insufficient validation of these parameters allows the kernel to modify security-sensitive packet fields after they have already been checked.
During his demonstration, Yibelo used a packet measuring just 28 bytes, including a 20-byte IPv4 header. Specially crafted metadata caused the kernel to write the checksum to the wrong location, modifying the header length field. As a result, the system began interpreting the 20-byte header as a 60-byte header, even though the actual packet size remained unchanged.
Because the validation had taken place before the header was modified, the kernel continued processing the packet using the now-invalid information. During the subsequent attempt to copy 60 bytes, it included an additional 32 bytes from host memory that were not part of the packet’s logical data.
“The next 32 bytes were not part of the packet’s logical linear data,” the researcher explained.
This allows an attacker to repeatedly retrieve fragments of host server memory that would normally be inaccessible from a guest virtual machine. Such behavior creates a risk of exposing sensitive information stored in the host system’s memory.
According to Yibelo, PwnEscape’s capabilities are not limited to reading memory. During laboratory testing, he managed to develop the attack further and achieve controlled writes to the host system’s kernel memory.
“Using host-memory observations and carefully controlled allocation behavior, we demonstrated selected 64-byte host-kernel writes,” the report states.
This means the vulnerability could potentially allow attackers not only to extract sensitive data but also to modify the contents of Linux kernel memory. In his own test environment, the researcher demonstrated a complete virtual machine escape and the execution of commands with root privileges on the host system. The attack was successfully reproduced in four independent laboratory runs, each involving a complete reset of the environment.
The PwnEscape researchers’ diagram illustrates five stages of testing: identifying the vulnerability, leaking 32 bytes of memory, reproducing the results, performing controlled writes to kernel memory, and executing commands on the host server.
However, the published technical documentation does not yet provide a complete explanation of how the researchers progressed from reading and writing memory to taking control of the system. The researcher has promised to reveal the details of this stage in the second part of the report. Importantly, command execution was confirmed only on the researchers’ own laboratory servers, not in a cloud provider’s production environment.
Following the disclosure of the vulnerability, it emerged that other cybersecurity experts had independently identified the same issue. In particular, Adel Ka, Head of Detection and Response at Perplexity AI, reported on X that he had managed to rediscover the vulnerability in less than two hours after seeing a screenshot related to Vercel’s bug bounty program.
According to him, a single clue was enough to identify the vulnerability: VirtIO. It is an open standard for communication between virtual machines and host systems, designed to enable efficient operation of virtualized devices.
Yibelo himself acknowledged that rediscovering the vulnerability became significantly easier after discussions about it appeared on public Linux kernel developer mailing lists.
The researcher also warned that PwnEscape could represent an entirely new class of vulnerabilities in the Linux networking stack. Specifically, the issue involves situations where untrusted checksum metadata can modify critical packet fields after the kernel has already validated them and used them to make processing decisions.
“As far as we know, PwnEscape exposes an entirely new class of attacks in Linux networking: untrusted checksum metadata can rewrite security-sensitive packet fields after the kernel has already validated and acted on them, undermining assumptions across the networking stack far beyond the original VM escape,” Yibelo concluded.
Linux developers have already prepared a patch for PwnEscape. It was accepted on October 8, 2026, and merged into the mainline Linux kernel on October 14. However, at the time of disclosure, the update had not yet reached all vulnerable systems and Linux distributions.
The patch introduces an additional validation step before checksum calculation. The kernel must now ensure that the checksum result will not be written into the IPv4 header, while improperly constructed packets must be rejected. This protection prevents the modification of critical header fields through the mechanism described above.
The vulnerability was discovered during the Vercel Sandbox bug bounty program, which invited researchers to test the security of isolated environments. The program offered a total prize pool of $1 million, and Yibelo received $50,000 for discovering the critical flaw.
The size of the reward sparked discussion among cybersecurity professionals because the vulnerability affects not only a specific Vercel product but also the broader Linux ecosystem and cloud platforms.
The potential consequences of PwnEscape could be far-reaching due to the widespread use of Linux and KVM in cloud infrastructure. Under certain conditions, compromising a single virtual machine or an insufficiently secured workload could allow an attacker to take control of the entire host server, including other systems running on it.
At the same time, there have been no confirmed reports of PwnEscape being exploited in real-world cyberattacks. Nevertheless, server administrators and cloud infrastructure operators should install the relevant Linux kernel security updates as soon as they become available for their systems.
