---
title: Vercel's $1M sandbox challenge found a Linux kernel networking zero-day that escapes KVM/Firecracker microVMs | ctxsec
url: https://ctxsec.com/items/vercel-sandbox-kernel-zero-day
description: ""
status: "confirmed (vendor); kernel bug now CVE-2026-99999"
published: 2026-10-14
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/vercel-sandbox-kernel-zero-day.md)

confirmed (vendor); kernel bug now CVE-2026-99999

2026-10-14

### Vercel's $1M sandbox challenge found a Linux kernel networking zero-day that escapes KVM/Firecracker microVMs

Vercel published results of its two-week $1M HackerOne challenge against Vercel Sandbox, its Firecracker-microVM isolation for untrusted AI-agent code: 1,285 reports (877 duplicates, 57 valid), $242,000 paid, and no report showing access to customer data. The top finding, from Paulos Yibelo (pwn.ai) on day three, is an upstream Linux kernel networking-stack defect: crafted packets from inside a microVM can leak host memory (demonstrated against Vercel production), crash the host with two packets, and run commands as root on the host (shown on the researcher's matching KVM/Firecracker setup). Update Oct 15: the kernel bug is now public as CVE-2026-99999 ("PwnEscape", CVSS 9.3), fixed in stable kernels 5.10.272 / 5.15.223 / 6.1.190 / 6.6.159 / 6.12.113 / 6.18.57 / 7.2.11; see the News item. Vercel says almost every major cloud isolates workloads on the same kernel layer. A Vercel intern also found a device-mapper bug that let sandboxes read recycled disk blocks, and a researcher showed a guest-trusted snapshot record enabling cross-account restore. Trail of Bits' advice: never trust values from the guest, use one policy decider, and assume the next zero-day.

Sources: [Vercel: findings from the $1M challenge](https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge) · [Challenge announcement](https://vercel.com/blog/one-million-dollar-hacker-challenge-for-vercel-sandbox) · [CVE-2026-99999 record](https://www.cve.org/CVERecord?id=CVE-2026-99999)