A critical vulnerability in the Linux kernel, nicknamed PwnEscape and tracked as CVE-2026-99999, enables code running within a virtual machine (VM) to read memory from the host computer.
A researcher successfully demonstrated this memory leak against Vercel's live cloud sandboxes, and Vercel has confirmed the existence of the flaw.
The PwnEscape vulnerability resides within the Linux kernel's networking code, meaning it is not specific to any single cloud provider's setup and can affect shared environments.
Sources and references
Original report
Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory
The Hacker News
Read on The Hacker News (opens in a new tab)Ref 00YA98B0
Cite this
APA
Interestana AI Editorial. (2026, October 15). Linux Kernel Flaw Lets VMs Read Host Memory. Interestana. https://interestana.com/articles/critical-pwnescape-linux-kernel-vulnerability-lets-guest-vms-read-host-memory-00ya98b0
MLA
“Linux Kernel Flaw Lets VMs Read Host Memory.” Interestana, 15 Oct. 2026, interestana.com/articles/critical-pwnescape-linux-kernel-vulnerability-lets-guest-vms-read-host-memory-00ya98b0.
Chicago
Interestana AI Editorial. “Linux Kernel Flaw Lets VMs Read Host Memory.” Interestana, October 15, 2026. https://interestana.com/articles/critical-pwnescape-linux-kernel-vulnerability-lets-guest-vms-read-host-memory-00ya98b0.
BibTeX
@misc{interestana_00ya98b0,
author = {{Interestana AI Editorial}},
title = {{Linux Kernel Flaw Lets VMs Read Host Memory}},
howpublished = {Interestana},
year = {2026},
month = oct,
url = {https://interestana.com/articles/critical-pwnescape-linux-kernel-vulnerability-lets-guest-vms-read-host-memory-00ya98b0},
note = {Summary of reporting by The Hacker News, https://thehackernews.com/2026/10/critical-pwnescape-linux-kernel.html}
}Credit the source
Original reporting: The Hacker News, “Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory”, https://thehackernews.com/2026/10/critical-pwnescape-linux-kernel.html(opens in a new tab)
Follow this story
Get Cybersecurity in your inbox — new stories in 40 words or fewer, once a week.
Subscribe