Researchers Use AI to Discover Critical Linux Kernel Flaw That Enables Virtual Machine Escape

Researchers at pwn.ai used an AI-assisted research harness to find a critical Linux kernel networking flaw, tracked as CVE-2026-99999 and nicknamed “PwnEscape”.

It lets an untrusted guest virtual machine leak host kernel memory and, in lab conditions, escape to the host. The bug is in the Linux networking stack, not in KVM or any hypervisor.

Linux kernel VM escape

According to research published by pwn.ai, the discovery came from Vercel’s $1 million Sandbox challenge, announced on August 18, 2026.

Researchers used Omega-Pwn, an experimental harness that draws on elements of OmegaClaw and uses GPT-5.6 Sol for source-level analysis. Humans set the scope and decided what counted as evidence.

They reached the first primitive within three days. They say the whole effort cost under $700 in API tokens. Vercel called it the program’s most important report and recorded it as its only Critical finding.

The flaw involves deferred checksum metadata in the Linux sk_buff structure. When a packet is marked CHECKSUM_PARTIAL, the fields csum_start and csum_offset decide where the kernel will later write the checksum. A guest can control these values through virtio.

The kernel first parses an IPv4 header with a header length (IHL) of 5, which is 20 bytes. Later, during output fragmentation, ip_do_fragment() calls skb_checksum_help().

With malicious metadata, that call overwrites the header’s first byte, changing it from 0x45 to 0x4f. The fragmenter then treats the header as 60 bytes long.

The logical linear data was only 28 bytes. The fragmenter therefore copied 32 bytes of host memory into the outgoing packet as apparent IP options. This is a time-of-check/time-of-use problem, but a deterministic one rather than a thread race. The researchers call the pattern “deferred-metadata trust inversion”.

The researchers escalated the 32-byte disclosure on their own KVM test hosts. They demonstrated selected 64-byte host-kernel writes and executed a host-root helper. Four separate cold boots completed the chain.

They also confirmed a host-availability failure on Linux 6.12 and 7.x test hosts. They stress that this was not a claim of root access in any vendor’s production environment.

They expect exploits for weaker configurations within weeks. They expect exploits for default hypervisor configurations in under a month.

The accepted patch is commit 6785011f8b16, “ipv4: validate checksum_start before completing checksum”. It was written by Michael S. Tsirkin. It adds an ip_check_csum_start() helper that rejects any csum_start below the network header start plus the IPv4 header length.

The check is placed before checksum completion at five consumer sites. The commit describes the patch as defense in depth, and broader ingress validation still needs work.

Recommended actions include applying kernel updates once stable backports land, while checking live kernel records because CVE publication and backports are still being finalized.

Hypervisor and sandbox providers should review their own exposure, as Vercel has notified other affected providers. Security teams should also treat host networking as part of the VM isolation boundary, and monitor for guest traffic carrying unusual IPv4 options.

The researchers plan a second article covering the move from the primitive to full host control. They also plan a separate post on the network-escape findings.