Host Memory Primitive in Firecracker MicroVMs Enables Root Access via CVE-2026-99999
Researchers detail a two-part exploit chain that breaks out of Firecracker microVMs to achieve root access on the host machine.
Key points
- The exploit leverages a host memory primitive to locate and modify saved registers.
- Attackers redirect thread execution when the vCPU returns from KVM to userspace.
- The vulnerability is tracked as CVE-2026-99999 in Firecracker setups.
Researchers have published details of a complete escape from Firecracker microVMs, achieving root code execution on the host system. This demonstration, labelled PwnEscape Part 2, builds upon a previously disclosed host memory primitive to take over a live thread from within the guest environment.reportedResearchers showed how to break out of a secure virtual machine and take full control of the computer it runs on.The exploit modifies pt_regs to hijack the vCPU thread's return path from KVM_RUN, achieving arbitrary code execution. The work shows CVE-2026-99999 on a Firecracker setup.reported
How we got here
The exploit chain relies on the architectural design of Firecracker, where each virtual CPU corresponds to a host thread. According to the report, this thread enters the kernel via KVM to run guest code and returns to userspace when events require handling.reported The host kernel saves the thread's userspace registers in a structure called pt_regs while the thread is in the system call.
What is new
The attackers used their existing access to selected host physical memory to identify the Firecracker process and locate the register frame for an active vCPU thread. By modifying the instruction and stack pointers in the saved frame, they could dictate which code Firecracker executed upon returning from KVM. A guest operation triggering this return served as the activation mechanism for the takeover.
What to watch
The guest restored temporary stack changes after the exploit. Firecracker kept running, and the VM remained accessible over SSH.
Availability and limits
For AI application developers using Firecracker for isolation, this demonstrates a failure in the security boundary between untrusted guest code and the trusted host. The exploit described used access to selected host physical memory through a guest mapping to identify the Firecracker process and find code to call.
Why it matters
- The escape achieved code execution as root on the host, compromising the security of the underlying machine.
- Firecracker is designed to keep untrusted code inside a microVM, so this breach violates its core isolation purpose.
- The attack allows an attacker to take over a live thread from inside the guest, demonstrating a critical failure in boundary enforcement.
- The VM remained accessible over SSH after the exploit, indicating that the compromise can be sustained without immediate detection or crash.
Topics: Firecracker, CVE-2026-99999, VM escape, KVM, security
Updated
The strongest doubt
Counterpoint from the sources
The exploit required prior access to host physical memory through a guest mapping.
Ask the article
Local keyword search of this article; no generated answers.Did this article give you the evidence you needed?
Your choice stays on this device. No public tally.Terms in this story
Firecracker
A virtualisation technology that uses microVMs to isolate untrusted code.
KVM
Kernel-based Virtual Machine, a Linux kernel module for hardware virtualisation.
pt_regs
A kernel structure that saves userspace registers during system calls.
vCPU
Virtual CPU, a virtualised processor core presented to the guest VM.
Questions readers ask
What is CVE-2026-99999?
It is a vulnerability in Firecracker that allows an attacker to escape the microVM and execute code as root on the host.
Does the exploit crash the host?
No, the report states that Firecracker kept running and the VM remained accessible over SSH after the escape.
How did the attackers trigger the code execution?
They modified saved registers so that when the vCPU thread returned from KVM, it executed code chosen by the attacker.
Reading receipt
- The exploit leverages a host memory primitive to locate and modify saved registers.
- Attackers redirect thread execution when the vCPU returns from KVM to userspace.
- The vulnerability is tracked as CVE-2026-99999 in Firecracker setups.