Linux Kernel allows host memory reading from a VM; CVE-2026-99999 patch.

The security community has confirmed a critical vulnerability in the Linux kernel network code that allows code that is already running within a virtual machine (VM) to read memory of the physical equipment that hosts it and, in laboratory, to advance to cause crashes and run code on that host. The decision was discovered by pwn.ai researchers during a security challenge organized by Vercel, reported in private to those responsible and received the reference CVE-2026-99999 and the 9.3 (Critics) rating in the public register.

What happened (confirmed facts): Paulos Jibelo, a pwn.ai researcher, demonstrated that specially built network packages sent from inside a microVM could filter bytes from the host memory; each package could return about 32 bytes and the process could be repeated. Vercel confirmed the demonstration against his production sandboxes and said there is no indication that anyone has read customer data in the reward program. The kernel maintainers applied a patch (commit 6785011f8b16) that adds checks so that the checksum data of a package does not point into the IPv4 header; this change has been integrated into the main branch and has been recarried to stable branches. The public record of the failure classifies it as "local" vectors: the attacker needs to be able to run code within the affected VM; it is not a remote operating vector simply by sending packages from the Internet.

How it works technically (explained with caution): the problem lies in the insufficient validation of certain structures used by the kernel network stack when processing checksums and references within IPv4 packages. If the kernel follows references within the package itself without checking that they do not point to undue header regions, a malformed package can induce readings outside the intended limits. These readings can exfilter memory fragments from the host's kernel space into the VM, and under controlled conditions the same failure can cause memory corruption that results in host falls or in the possibility of execution control. The patch introduces an additional five-point check of the network code to block Checksum references that point into the IPv4 header; the solution is rated by its author as a "in-depth defense" measure and requires additional work for earlier verification in the package entry.

Who it affects and why it matters: the main risk is cloud environments and any infrastructure in which multiple tenants share the same Linux kernel in the host (i.e. the layer that runs and manages VMs or microVMs). Vercel uses microVMs Firecracker on bare-metal hosts in Amazon EC2; the failure is not in Firecracker but in the kernel running in the host, so any supplier using a similar stack could be affected until the patch is applied to their host kernel. On the other hand, the vector requires that the attacker already execute code within a VM; it is not an exploitable vulnerability from the outside simply by an attacker who sends packages from the Internet.

What they showed in the lab and what is uncertain: In laboratory pwn.ai showed continuous memory reading (~ 32 bytes per package), two packages were enough to drop a host and, with replicated configurations, managed to manage the host. Vercel confirms the memory leak in its production but clarifies that there is no evidence that customer data were read in its reports to the challenge. These advances towards "code execution in the host" and "administrative control" were reproduced by the researcher in machines configured to imitate the Vercel platform; both points are claims of the research team and, as they themselves stress, correspond to laboratory results rather than to holdings observed outside the controlled environment. There are, so far, no verified public reports of exploitation in the real world.

Patch and status of deployment: the main change is available in the main branch of the kernel and has been back to stable branches; its author was Michael S. Tsirkin (Red Hat). System managers and suppliers should apply the kernel update to the supplier's physical hosts or build that include the patch and restart the hosts for the correction to enter into force. It is important to check the ads of the own distribution or the image provider, because some distributions make corrections without changing the declared version number by one; therefore, confirm that the specific patch is present in the binary running the host and not based only on the numerical version. For technical reference of the patch see the kernel repository: commit 6785011f8b16, and for the microVM context used by Vercel see Firecracker: https: / / github.com / firecracker-microvm / firecracker. See also the public entry of the EVC in the national database: https: / / nvd.nist.gov / vuln / detail / CVE-2026-99999.

Specific recommendations for cloud managers and managers: Upgrade host kernel to the built-up patch as soon as possible and reprogram / restart hosts to boot with the corrected version; check with your supplier that public hosts have received the correction. It is not enough to update guest kernel: the failure is in the host kernel. If you cannot park immediately, reduce the risk of climbing: limit the capacity of unverified tenants to run arbitrary code on VMs, disable unnecessary features such as nested virtualization, apply strict network controls to VMs that run unreliable code, and use additional isolation mechanisms (jailers, minimum permit policies). Audit log and VMs traffic patterns to detect unusual bursts of small packages originating in guests (indicators consistent with repeated package exfiltration technique).

Recommendations for developers and users of cloud services: If you use managed platforms, check your notices and confirm that the supplier has applied the correction to the hosts that house your charges. For critical operations requiring maximum confidentiality, consider applying for accommodation in dedicated hosts or in isolated physical instances until most suppliers have the patch deployed. Keep regularly rotated secrets and keys as mitigation practice in the face of undetected leaks.

The discovery is also a reminder that the "shared" dimension of the kernel in multi-tenant environments is a risk area and that the maintenance and rapid deployment of corrections in the host layer are essential. The case also illustrates how advanced tools, including language models in the research process, are accelerating vulnerability identification: pwn.ai claims to have used its IA-assisted platform to find and channel the failure in days and at reduced cost, a relevant note for organizations that defend common infrastructure.