This one matters because of where it lives. It is not a Firecracker bug or a KVM bug. It is in the host’s IPv4 networking code, the layer almost every cloud uses under its tenant isolation, and the affected range in the CVE record starts at kernel 2.6.27. Vercel’s own write-up frames it the same way: a defect in the upstream Linux kernel that is a risk to shared infrastructure, not to one provider.
The mechanism. Per the CVE record, a malicious microVM supplies crafted virtio-net checksum metadata with an outbound frame. The VMM writes it to the host TAP device, tun_get_user() feeds the packet into the IPv4 stack, and ip_do_fragment() calls skb_checksum_help(). Because checksum_start was never validated, the guest can make the kernel rewrite an IPv4 header after it has already been checked. pwn.ai says each packet carried back about 32 bytes of host memory, repeatable for as long as the guest keeps sending. Two crafted packets crashed a host and every sandbox on it. Code execution on the host was shown only on the researcher’s own lab machines, not in any vendor’s production.
How it was found. Vercel’s $1M Sandbox challenge in August drew 1,285 reports over two weeks and paid $242,000; this was the only Critical finding, and it landed on day three. pwn.ai says it used its own AI-assisted research harness, with humans directing and validating, and put the token cost under $700 (per The Hacker News). Vercel says no report showed anyone reaching customer files, secrets or application data.
The fix. One kernel change, 6785011f8b16 (“ipv4: validate checksum_start before completing checksum”) by Red Hat’s Michael S. Tsirkin, applied to net.git Oct 8 and merged to mainline Oct 14. First fixed stable versions per the CVE record: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, 7.2.11. The author calls it defence in depth; a fuller check on the ingress path is still being worked on. No separate workaround was published.
What we’d do tonight. Inventory every host where untrusted code runs in a guest: multi-tenant KVM, Firecracker or Kata fleets, CI runners, AI-agent and code-execution sandboxes, VDI. Patch the host kernel and reboot into it; updating guest kernels does nothing here. Distros backport without bumping the upstream number, so confirm against your vendor advisory and the kernel actually running, not just uname. Until hosts are done, narrow the blast radius the way Vercel does: disable nested virtualization, run each microVM under a jailer with minimal privileges, and keep secrets off shared hosts. If you rent sandboxes from a provider, ask them directly when their host fleet took the fix.