Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory
Summary
A critical vulnerability, dubbed PwnEscape (CVE-2026-99999), has been discovered in the Linux kernel that allows code running within a virtual machine to read memory from the host system. A researcher successfully demonstrated this exploit against Vercel's cloud sandboxes, and the company has confirmed the issue.
IFF Assessment
This vulnerability allows an attacker in a guest VM to access sensitive data residing in the host's memory, posing a significant risk to data confidentiality and system integrity.
Severity
Defender Context
This vulnerability highlights the persistent risks associated with virtualized environments, particularly when kernel-level flaws are discovered. Defenders should prioritize patching Linux kernels in their environments and vigilantly monitor for any signs of exploitation targeting cloud infrastructure or internal virtualized systems.