Vercel sandbox kernel zero-day vulnerability disclosed; Japanese cloud provider suspends new applications

Linux kernel IPv4 network stack vulnerability PwnEscape (CVE-2026-99999, cve.org score 9.3) allows a virtual machine guest to read host memory; the fix entered the kernel mainline on 2026-10-14. The vulnerability was submitted by researcher Paulos Yibelo (PWNAI Research) in Vercel's million-dollar Sandbox challenge and was the only one judged Critical among 1285 reports; Vercel says the host memory leak has been demonstrated in its own production sandbox. Mechanically, the guest provides checksum metadata via virtio, and when the host delays write-back it does not skip realignment along with the Ethernet header; after the IPv4 header length field is rewritten, 32 bytes of out-of-bounds-read host memory are sent out in the form of IP options; crashing the host and executing code as root were demonstrated only in the researcher's own KVM and Firecracker environments.

While responding to the Linux kernel network processing vulnerability CVE-2026-99999 (PwnEscape), Sakura Cloud has suspended the creation of new "projects" from 16 October. Already created projects remain usable, and existing resources are unaffected; applications for Sakura's Dedicated Server PHY or Takakaryoku PHY that require creating a new project cannot currently be submitted. Related maintenance will be carried out in stages, and affected customers are planned to be notified one week in advance via their registered email addresses.

Security company pwn.ai researcher Paulos Yibelo disclosed a critical vulnerability CVE-2026-99999 (codename PwnEscape) in Linux kernel networking code that can read host memory from a virtual machine. The issue was demonstrated on Vercel's production sandbox and confirmed by Vercel. Each packet can retrieve about 32 bytes of host memory, and two specially crafted packets can crash the host and bring down all sandboxes on it; the crash and code execution were only reproduced on a machine built by the researcher according to Vercel's configuration, and the researcher stated this is not a claim of root command execution on any vendor's production environment. The fix is kernel commit 6785011f8b16, which the author describes as a defense-in-depth measure, backported to stable branches such as 5.10.272, 6.6.159, and 6.12.113. The CVE record is rated 9.3 (Critical), with an attack vector of local, requiring the attacker to already run code inside the guest, and no actual attacks have been reported.

pwn.ai discloses technical details of CVE-2026-99999: a delayed write in Linux kernel IPv4 checksum handling can rewrite an already-checksummed IPv4 header, and researchers used this in their own KVM environment to achieve guest-to-host escape. The root cause is that checksum metadata is not compared against network header boundaries before completion; it initially manifested as a 32-byte host memory leak per occurrence, then a 64-byte kernel write was demonstrated in their own test environment, and after four cold boots a host root helper program was executed. The research was completed during the $1 million Sandbox challenge launched by Vercel on August 18, 2026, using pwn.ai's Omega-Pwn research framework with GPT-5.6 Sol as the primary reasoning engine. The upstream fix 6785011f8b16 adds ip_check_csum_start checks to five IPv4 checksum completion paths and entered net.git on October 8.

Vercel announced the results of its $1 million Vercel Sandbox escape challenge, receiving 1,285 reports in two weeks and paying $242,000 in bounties. The most severe issue was a zero-day vulnerability in the Linux kernel network stack. Researcher Paulos Yibelo sent specially crafted packets from within a microVM, which could leak host memory to the network, crash the host, and execute code on the host with administrator privileges. Vercel said it worked with vendors such as AWS to prioritize fixes; the patch is still under private review and a CVE is pending. A Vercel intern also discovered a cross-tenant data leak in the device-mapper storage layer that could read recycled disk blocks from deleted sandboxes. Trail of Bits submitted 20 findings over four engineer-weeks, concluded that the virtualization boundary is reliable, and proposed three structural recommendations that have been implemented. Vercel said no reports indicated customer data was read.