Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory

A critical Linux kernel vulnerability dubbed PwnEscape (CVE-2026-99999) has been disclosed, allowing code running inside a virtual machine to read memory on the host system. The flaw resides in the Linux kernel's networking code, making it broadly applicable across cloud environments rather than specific to any single provider's configuration. A security researcher demonstrated the vulnerability against Vercel's live cloud sandboxes, and Vercel confirmed the successful exploit. Because the issue is in the kernel itself, any cloud or hosting provider using affected Linux kernel versions may be at risk. This type of VM escape or cross-boundary memory read is considered critical as it undermines the fundamental isolation guarantees of virtualization. The vulnerability has been assigned a CVE identifier and is actively being tracked by the security community. Patches or mitigations are expected from Linux kernel maintainers and downstream distributions.