Update 16 Oct: the guest-to-host escape Vercel's CEO confirmed on 3 October now has a CVE and a public write-up. Researcher Paulos Yibelo of pwn.ai published 'PwnEscape' on 15 October and the Linux kernel CNA assigned CVE-2026-99999, rated 9.3 Critical (CVSS 3.1, local attack vector, scope changed); NVD had received but not yet analysed it. The bug is not in KVM or Firecracker but in the host kernel's IPv4 networking code: checksum metadata supplied by a guest could point into the IPv4 header, so skb_checksum_help could rewrite the header after the kernel had already validated it.

Vercel's own findings post (14 Oct) says the host-memory leak was demonstrated against its production Sandbox: each packet a guest sent could carry back about 32 bytes of host memory, repeatably. Crashing the host with two crafted packets and getting root on the host were shown only on the researcher's own machines built to match Vercel's; he stresses this is not a claim of root in any provider's production.

Vercel says no report showed anyone reading customer files, secrets or app data, and called it the challenge's only Critical finding. Because most clouds isolate tenants on the same Linux host networking layer, the exposure is broad for anyone running untrusted guests. The fix is a single commit (6785011f8b16) by Red Hat's Michael S. Tsirkin, which its author calls a defence-in-depth check; fuller input validation is still being worked on.

An attacker must already run code inside a guest; it is not reachable from the open internet, and there is no known in-the-wild use or CISA KEV listing. pwn.ai says the research used its Omega-Pwn harness with an AI model as the main reasoning engine.

Earlier wire-only reporting (Rauch X post 3 Oct, Tech Insider and CSN 4 Oct) said Vercel paid US$50,000.

UPDATE (20 Oct): Red Hat rates CVE-2026-99999 Important, CVSS 3.1 8.8 (it scores privileges required as low, unlike the CNA's 9.3), lists every tracked RHEL stream from 6 to 10 (kernel and kernel-rt), RHEL for NVIDIA and OpenShift 4 CoreOS as affected with fixes still in progress, and says no acceptable mitigation exists.

WA's Cyber Security Unit issued advisory 20261019001 on 19 October and has seen no exploitation on WA Government networks.

Primary: pwn.ai write-up and kernel commit; vendor: Vercel; wire: The Hacker News (16 Oct).