The kernel bug from Vercel's $1M sandbox challenge is now CVE-2026-99999 — and NVD hasn't listed it

A Linux kernel flaw that lets a guest virtual machine corrupt memory on its host was published as CVE-2026-99999 on October 15, 2026, with a CVSS base score of 9.3. It is the kernel zero-day from Vercel's million-dollar sandbox challenge. Anyone running untrusted workloads in VMs should check their kernel version; Red Hat still lists its distributions as affected with no fix shipped, and as of October 18 the record does not appear in NVD at all.

What happened, in plain English

Every network packet carries a checksum, a small number used to detect corruption in transit. To save work, the kernel sometimes defers calculating that checksum and keeps a note of where in the packet it should go. The flaw is that the kernel did not verify this note was sane before acting on it. A packet crafted with a bad offset causes the helper function that completes the checksum to write outside the area it should, corrupting the network header and the memory around it.

In the CVE record's own scenario, the packets come from a guest virtual machine using virtio-net, the standard virtual network device. That matters because it crosses a boundary that is supposed to hold: code inside the VM reaching memory belonging to the host. The possible outcomes are a host crash, leaked host memory, or code running on the host.

The bug is old. It is present from kernel 2.6.27, released in 2008, which means essentially every Linux system in production has carried it. What is new is that someone noticed it, during a two-week contest with a $1,000,000 prize attached.

That contest was Vercel's, and the context is worth a moment: Vercel Sandbox exists so that code written by AI agents can be executed somewhere it cannot do damage. The bug turns part of that promise — the kernel boundary underneath the sandbox — into the weak point. Our brief from October 14 on the Vghost flaw covered a different kernel bug with the same shape, four days earlier.

Are you affected? What to do now

You are affected if you run a Linux kernel older than the fixed versions below, and the exposure is serious if anyone untrusted can send packets from inside a VM or container on your hosts — a hosting provider, a CI runner, a sandbox for agent-generated code, a multi-tenant Kubernetes cluster. On a single-tenant machine where you control everything that runs, this is a much lower priority.

• Check your kernel. uname -r. The fix is in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 and 7.2.11; upstream it landed in 7.3-rc7. Anything older on those branches is unpatched.
• Check your distribution, not just the version number. Distributions backport fixes without changing the upstream version, so the number above is not the whole answer. Red Hat's CVE page currently marks kernel and kernel-rt as Affected on RHEL 6 through 10, RHEL for NVIDIA 26, and the OpenShift Container Platform 4 CoreOS images, with no errata yet and no mitigation offered. Check your own vendor's tracker the same way.
• Prioritize the hosts that run other people's code. Hypervisors, sandbox fleets, CI workers, shared container hosts. Patch there first; everything else can follow the normal cycle.
• If you cannot patch yet, reduce what can reach the stack. The attack comes through virtio-net traffic from the guest, so hosts where every guest is trusted, or where guest networking is tightly constrained, are a smaller target. There is no vendor-published workaround to apply, so this is risk reduction, not a mitigation.
• Do not wait for NVD. The record is live on cve.org and with vendors, but NVD returns "CVE ID Not Found" for it today. If your vulnerability scanner syncs only from NVD, this flaw is currently invisible to it — worth checking how your tooling is fed.
• Nothing to hunt for. No indicators of compromise have been published, and CISA's enrichment data records no known exploitation. Detection here means patch state, not threat hunting.

The expert view

The root cause is a missing bounds check on attacker-influenced metadata: skb_checksum_help acted on a checksum_start offset that nothing had validated against the actual buffer. The upstream commit describes itself as defense in depth, with fuller input validation still to come — which usually means the maintainers consider the surrounding code path insufficiently defensive in general, not that this one check closes a category.

The two published scores disagree in a way that tells you something. The CVE Program record scores 9.3 with privileges required set to none; Red Hat's preliminary score is 8.8 with privileges required set to low, and both mark scope as changed. The scope change is the interesting half — it is the formal way of saying the impact lands outside the component that was attacked, which here means the host. Whether you need a foothold first is exactly the question the two scores answer differently, and that disagreement will probably resolve when Red Hat finalizes its analysis. Treat it as a critical issue on multi-tenant hosts either way.

The provenance is the part worth dwelling on. This came out of a two-week bounty window in which, by Vercel's own account, 1,285 reports arrived, 57 were valid and $242,000 was paid — and the most severe finding, reported on day three by Paulos Yibelo of pwn.ai, was this kernel zero-day. Vercel writes that researchers "now hunt at AI speed" and that some "steered their agents straight at the kernel boundary." That is a claim about the field, not about this bug: Vercel does not say the flaw was found by an AI system, and neither does the CVE record. We could not reach the researcher's own write-up to check, so the honest statement is that a bug dormant since 2008 surfaced in three days once a large prize pointed skilled people — using whatever tooling they chose — at one narrow boundary.

The gap in the public record is its own lesson. The flaw is fixed upstream, documented by the Linux CNA, and tracked by Red Hat, yet an organization whose scanning pipeline depends on NVD sees nothing. That lag is not new, but it is longer than it used to be, and a nine-point kernel bug is a poor one to discover late.

Official sources

• CVE-2026-99999 — CVE Program record, assigned by the Linux CNA, published October 15, 2026 (description, affected and fixed versions, CVSS 9.3)
• CVE-2026-99999 — Red Hat Product Security: severity Important, preliminary CVSS 8.8, affected product list, no mitigation available
• Findings from the $1 million Vercel Sandbox challenge — Vercel, Andy Riancho, October 14, 2026 (challenge results and the report that led to this CVE)
• nvd.nist.gov record — returns "CVE ID Not Found" at the time of writing

Coverage: the researcher's write-up at pwn.ai, referenced by the CVE record, was unreachable when this brief was written; we will update if it adds detail.