An isolation failure in the Linux kernel’s network handling allowed a guest virtual machine to breach the boundary separating it from the host it runs on. Security teams can track the defect as CVE-2026-99999, and fixes now exist on seven stable branches.
An IPv4 header sat at the center of the problem. Packet metadata the guest controlled drove a write that rewrote that header once the kernel had already finished reading it, and the change landed before fragmentation code touched the packet again. In his proof, Yibelo stretched the header’s parsed length from 20 bytes all the way to 60.
Tied to a sandbox contest
Paulos Yibelo, a researcher at Pwn.ai, found the weakness while taking part in a Vercel security contest called the Sandbox challenge, which offered $1 million and opened on August 18. Contestants were told to attack the isolation layer around Vercel’s infrastructure, including whether a virtual machine could reach its host.
Some security bugs need a thread race to bite. This one did not, since the malformed write unfolded during routine traffic handling rather than as a timing attack, Yibelo wrote in a post. Vercel rated the finding the gravest submission it received.
Andy Riancho, the firm’s principal security engineer, said the crash and code-execution attacks tied to packets were shown on the researcher’s own KVM and Firecracker boxes set up to mirror Vercel Sandbox. Nothing indicated that customer data had been touched, he added, and the matter is closed.
The upstream remedy arrives as commit 6785011f8b16, which inserts checks ahead of the checksum-completion steps. It landed in the Linux development tree on October 8, then graduated to mainline on October 14. Yibelo called the change a defence-in-depth measure. An NVD write-up lists the patched releases as 5.10, 5.15, 6.1, 6.6, 6.12, 6.18 and 7.2.
