PwnEscape Flaw Escapes Firecracker MicroVM to Root on Host Kernel

A critical Linux kernel flaw scored 9.3 by the kernel's own CVE team has been turned into a full escape from a Firecracker micro virtual machine — code execution with root privileges on the host, straight from an untrusted guest.

Security researcher Paulos Yibelo of pwn.ai found the bug, CVE-2026-99999 or PwnEscape, during Vercel's US$1 million sandbox security challenge and disclosed it in mid-October. The flaw does not sit in Firecracker, Amazon's open-source virtual machine monitor, nor in KVM. It lives in the host kernel's IPv4 networking code — specifically the virtio-net/TAP path that processes packets arriving from guests. That's why operators running their own KVM hosts are the ones holding the patch ticket.

How does a packet become root?

The mechanics read like a slow-motion collision. Linux allows a packet to carry instructions for computing its checksum later in processing. Yibelo discovered that a guest could steer that deferred write onto an IPv4 header the kernel had already parsed and trusted — flipping the header-length field from 20 bytes to 60.

From there, fragmentation code copies 60 bytes from a buffer holding only 28 bytes of logical linear data. The difference — 32 bytes of adjacent host memory — leaks out in outgoing packets. "Different parts of Linux were allowed to trust different versions of the same packet," Yibelo wrote.

A follow-up exploit scales that leak into a takeover. The attacker:

• plants a marker in guest memory and locates the page in host physical memory,
• walks the host's page tables to find the Firecracker process,
• reads the binary's headers to defeat address randomisation,
• finds the registers the kernel saved for a virtual CPU thread waiting inside a KVM call, and
• overwrites the saved instruction pointer.

One byte written to the guest serial port forces the virtual CPU to exit to the host. The kernel restores the doctored registers, and Firecracker runs an attacker-chosen function as root. In the demo, that function printed proof of execution rather than opening a shell — and the researchers tidied the return path so Firecracker kept running and the guest stayed reachable over SSH.

One caveat matters for buyers: Yibelo ran Firecracker v1.16.1 without its jailer, directly as root — not a production configuration. The jailer drops the monitor's privileges and constrains it with namespaces, chroot and seccomp filters, blunting what an attacker can do after compromising the process.

What does this change for operators?

Amazon Web Services drew a hard line in an October 15 security bulletin: EC2, Lambda and Fargate are not affected. "There is no action required for customers using these services," AWS said.

Self-hosted KVM deployments are another story. AWS listed kernel versions 4.4 through 6.18 as affected, and nothing patched inside a guest can fix a host-side flaw. Operators must patch the host kernel and reboot. As of the end of October:

• Amazon Linux, Debian and Proxmox had shipped fixed kernel packages,
• Red Hat had released fixes for some products,
• SUSE and Ubuntu were still working through theirs.

Scoring split along predictably defensive lines. The Linux kernel CVE team rated the vulnerability 9.3, critical. Red Hat, Amazon and SUSE put it at 8.8 — important — on the assumption an attacker already needs privileges inside the guest.

The AI angle

Yibelo's team built the exploit using GPT-5.6 Sol, the same OpenAI model OpenAI benchmarked in its own Linux kernel research, as the primary reasoning engine in an experimental harness called Omega-Pwn. Total API token cost for the research came in under US$700 (about $1,018) — less than most enterprises spend on a single penetration-test line item, for a bug that forced kernel reboots across the hosting industry.

Patch the host. Reboot. Then check the serial port.