KVM escape + Linux kernel vulnerability + CVE-2026-99999 breakdown: 32-byte leak, breaking through the virtual machine boundary

Linux kernel IPv4 network stack vulnerability PwnEscape (CVE-2026-99999, cve.org score 9.3) allows a virtual machine guest to read host memory; the fix entered the kernel mainline on 2026-10-14. The vulnerability was submitted by researcher Paulos Yibelo (PWNAI Research) in Vercel's million-dollar Sandbox challenge and was the only one judged Critical among 1285 reports; Vercel says the host memory leak has been demonstrated in its own production sandbox. Mechanically, the guest provides checksum metadata via virtio, and when the host delays write-back it does not skip realignment along with the Ethernet header; after the IPv4 header length field is rewritten, 32 bytes of out-of-bounds-read host memory are sent out in the form of IP options; crashing the host and executing code as root were demonstrated only in the researcher's own KVM and Firecracker environments.