Affected Systems

Linux kernel networking code across all major cloud providers using kernel-based virtualization. Fixed in stable branches: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, 7.2.11. Affects bare-metal hypervisors running guest VMs with shared kernel networking stack (e.g., Firecracker, KVM-based environments).

Exploitation Status

No active exploitation reported. Discovered in Vercel security challenge and privately disclosed. Proof-of-concept demonstrated: memory read (32 bytes/packet), host crash (2 packets), and code execution in lab environment. Attack requires local access inside a guest VM; not remotely exploitable.

Business Impact

Guest-to-host escape vulnerability in multi-tenant cloud environments. Attacker with code execution inside a VM can read host memory, potentially exposing secrets, keys, or data from other tenants. Can crash host and all co-located VMs. CVSS 9.3 (Critical). Risk is highest for shared infrastructure providers (AWS, Azure, GCP, private clouds). Single-tenant or non-kernel-sharing isolation (e.g., separate physical hosts) not affected.

Urgency

🔴 Immediate

Recommended Actions

  • Update host Linux kernel to fixed versions: 5.10.272+, 5.15.223+, 6.1.190+, 6.6.159+, 6.12.113+, 6.18.57+, or 7.2.11+ and reboot hosts immediately
  • Verify fix deployment by checking for commit 6785011f8b16 in running kernel, not just version number; consult distribution-specific advisories (RHEL, Ubuntu, Debian, SLES)
  • Prioritize patching bare-metal hypervisors running multi-tenant workloads (AWS EC2 bare-metal, on-prem KVM/Firecracker clusters)
  • Review host kernel logs for unusual guest network activity or crashes since August 2026; no known IOCs but baseline normal behavior
  • If patching delayed, isolate high-risk tenants to dedicated hosts and disable nested virtualization; note this mitigates impact but does not fix the flaw