criticallivepatched
day · Oct 14, 2026
PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999)
› Linux kernel networking (host side of KVM/Firecracker and similar)
Get an email when a new major security incident drops. No spam, unsubscribe any time.
Updates on Oct 14, 2026
Mainline merge / public write-ups.
## summary
Paulos Yibelo / pwn.ai found a Critical Linux networking flaw (CVE-2026-99999, CVSS 9.3) during Vercel’s $1M Sandbox challenge. Guest-controlled checksum metadata can rewrite an IPv4 header after validation, enabling host-memory disclosure and, in lab conditions, guest-to-host code execution on KVM/Firecracker. Upstream fix merged Oct 2026; host kernels need patch + reboot. Affects multi-tenant VPS / sandbox providers more than end-user desktops.
read the full incident →
