Researchers turn PwnEscape Linux flaw into Firecracker breakout

A security researcher has turned a critical Linux kernel flaw into a working escape from a Firecracker micro virtual machine, running code with root privileges on the host from inside an untrusted guest.

The bug, CVE-2026-99999 or PwnEscape, was found by Paulos Yibelo of pwn.ai during Vercel’s US$1 million sandbox security challenge and disclosed in mid-October.

It does not live in Firecracker, Amazon’s open-source virtual machine monitor, or in the kernel virtual machine (KVM).

Instead, it sits in the host kernel’s IPv4 networking code, in the virtio-net/TAP path that handles packets from guests, potentially allowing an attacker inside an affected KVM guest to compromise the shared host.

Linux lets a packet carry instructions for calculating its checksum later in processing, and Yibelo found a guest could make that deferred write land on an IPv4 header the kernel had already parsed and trusted.

The write flips the header-length field from 20 bytes to 60.

Fragmentation code then copies 60 bytes from a packet buffer containing only 28 bytes of logical linear data, disclosing 32 bytes of adjacent host memory in outgoing packets.

“Different parts of Linux were allowed to trust different versions of the same packet,” Yibelo wrote.

A follow-up exploit applies that leak all the way to the host system.

Using the memory read and write primitive, the exploit plants a marker in guest memory, finds where that page sits in host physical memory, then walks the host’s page tables to locate the Firecracker process and reads the binary’s headers to defeat address randomisation.

It then finds the registers the kernel saved for the virtual processor thread while that thread waits inside a KVM call, and overwrites the saved instruction pointer.

A single byte written to the guest serial port forces the virtual CPU to exit to the host, where the kernel restores the doctored registers and Firecracker runs a function of the attacker’s choosing with root privileges.

For the demonstration, that function printed proof of execution rather than opening a shell, and the researchers cleaned up the return path so Firecracker kept running and the guest stayed reachable over SSH.

It is worth noting that Yibelo ran Firecracker v1.16.1 without its jailer, directly as root, which is not how production deployments are meant to run.

Using the jailer drops the monitor’s privileges and restricts it with namespaces, chroot and seccomp filters, limiting what an attacker can do after compromising the Firecracker process.

Amazon Web Services said its own EC2, Lambda and Fargate services were not affected.

“There is no action required for customers using these services,” AWS said in an October 15 security bulletin.

Operators running their own KVM hosts with virtio-net networking, including Firecracker deployments, have to patch the host kernel and reboot, since nothing inside a guest can fix the problem.

AWS listed kernel versions 4.4 through 6.18 as affected.

Amazon Linux, Debian and Proxmox have shipped fixed kernel packages, and Red Hat has released fixes for some of its products, while SUSE and Ubuntu were still working through theirs at the end of October.

The Linux kernel CVE team scored the vulnerability as 9.3, or critical, while Red Hat, Amazon and SUSE put it at 8.8, or important, on the assumption that an attacker needs some privileges inside the guest.

Yibelo’s team used GPT-5.6 Sol, the same OpenAI model the artificial intellgence company benchmarked in its own Linux kernel research, as the primary reasoning engine in an experimental research harness called Omega-Pwn.

pwn.ai put its application programming interface (API) token consumption costs for the research at under US$700 ($1018).