The flaw resides in the Linux kernel's networking code rather than in any specific cloud provider's configuration. Because the vulnerability lives at the kernel level, it affects the shared infrastructure layer common to many virtualized environments, meaning the exposure is not limited to a single platform or vendor setup.

Key points to note:

• CVE-2026-99999 is a Linux kernel networking flaw enabling guest-to-host memory disclosure.
• The attack path allows code inside a VM to read host memory.
• The issue was demonstrated against Vercel's cloud sandboxes, with the company confirming the finding.
• The root cause is in the kernel itself, not in a particular cloud deployment.
• Because it sits in shared virtualization infrastructure, the impact is far broader than one provider.

Source: The Hacker News

Are any of your workloads running on multi-tenant virtualized infrastructure that could be exposed to PwnEscape, and what mitigation steps is your team considering?