PwnEscape Part 2: with the earlier host-memory primitive, researchers took over a Firecracker VMM thread and ran code as root on a host that launched it without jailer
- What this adds: Part 1 was the Linux kernel IPv4 checksum bug that can give a malicious guest a host-memory primitive (see our Oct 15 item). Part 2 shows that primitive can be used to steer the Firecracker process itself when the VMM is running as unconstrained root.
- For agent and CI sandboxes that use Firecracker: patch the host kernel for CVE-2026-99999 first, and run Firecracker through its jailer with privilege dropping, namespaces and seccomp rather than launching the VMM as root.
- A deployment that already uses those jailer controls is outside the scope of this demo; do not treat the write-up as a claim that jailer is broken.
Sources: PWN.AI: Firecracker VM Escape — PwnEscape Part 2 · CVE-2026-99999 · Firecracker jailer documentation