CyberSecurity News

Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory

The Hacker News

· October 15, 2026

AI summary

A critical flaw in the Linux kernel allows code inside a virtual machine to access the host computer's memory. This vulnerability, known as PwnEscape, is located in the Linux kernel's networking code. A researcher successfully demonstrated the memory leak using Vercel's live cloud sandboxes, and Vercel has confirmed the issue. The flaw is not specific to any one cloud setup, but rather is a problem with the Linux kernel itself. It has been assigned the designation CVE-2026-99999. The vulnerability's presence in the kernel's networking code means it has broad implications.

Vulnerabilities mentioned

CVE-2026-99999

CRITICAL

CVSS 9.3

In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.

Read the full article at The Hacker Newsthehackernews.com/2026/10/critical-pwnescape-linux-kernel.html

This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to The Hacker News.