A new proof-of-concept has turned Linux kernel flaw CVE-2026-99999 into a guest-to-host escape from a Firecracker microVM, allowing code to run with root privileges on the host in the researchers’ test environment.
PWN Research’s Paulos Yibelo published the second part of the research on November 9, detailing how the exploit uses a host-memory access primitive to locate the Firecracker process and redirect a virtual CPU thread when it returns from KVM. The researchers’ technical write-up describes the demonstration, which they call PwnEscape.
CVE-2026-99999 is a Linux kernel flaw in IPv4 packet processing along the virtio-net/TAP networking path, not a vulnerability in Firecracker or KVM. Malformed checksum metadata can trigger an out-of-bounds write that corrupts kernel memory. Red Hat’s CVE entry says the flaw could lead to host code execution, sensitive-memory disclosure or denial of service. The upstream Linux kernel fix validates the checksum start position before completing checksum processing.
The test used Firecracker v1.16.1 on x86-64, with host kernel 7.0.0-1011-aws and guest kernel 6.18.44+. Yibelo launched Firecracker directly as root without its jailer. Firecracker’s design documentation says production deployments should start the VMM through the jailer, which sets up cgroups and a chroot before dropping privileges; Firecracker also applies seccomp filters. The demonstration therefore does not establish that the same root-level access would be possible with those production containment controls enabled. The proof of execution printed a marker to the host’s standard error rather than opening an interactive shell.
AWS’s security bulletin says the flaw affects self-managed KVM hosts using virtio-net on unpatched Linux kernels 4.4 through 6.18, and requires an attacker to have privileged access inside a guest VM. AWS-managed EC2, Lambda and Fargate services are not affected. Its Amazon Linux advisories list fixed builds including AL2 kernel 4.14.355-287.753.amzn2, 5.4.302-229.498.amzn2 and 5.10.269-270.1108.amzn2, plus AL2023 kernel 6.1.188-233.385.amzn2023, 6.12.110-135.201.amzn2023 and 6.18.54-121.166.amzn2023. The relevant AL2 4.14 advisory, AL2 5.4 advisory, AL2 5.10 advisory, and AL2023 6.1, 6.12 and 6.18 advisories provide the package details.
The underlying flaw was disclosed in mid-October; the new development is the Firecracker breakout demonstration. PwnEscape is separate from CVE-2026-98432, another Linux kernel flaw covered in Abijita’s reports on the Red Hat kernel patches and Veeam’s affected backup products. It also differs from the WorkOS incident involving an AI agent escaping a test environment, which involved access to an internal application rather than a kernel-level guest-to-host path.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
