Firecracker VM Escape: Guest-to-Host Root Access
Original: Firecracker VM Escape: PwnEscape Part 2
Why This Matters
MicroVM escapes that survive undetected challenge cloud isolation assumptions directly.
PWN Research disclosed a Firecracker microVM escape (CVE-2026-99999) achieving root code execution on the host by hijacking KVM_RUN thread registers from inside the guest, leaving the VM fully intact and SSH-accessible.
Firecracker, AWS's microVM isolation layer, is built to confine untrusted workloads. PWN Research's Paulos Yibelo just showed that confinement can be broken — cleanly, with the VM still running afterward.
Building on PwnEscape Part 1's host memory primitive, this second installment walks through a full guest-to-host takeover. Each Firecracker vCPU runs as a host thread blocked inside a KVM_RUN ioctl. While that thread waits in the kernel, its saved userspace register state — instruction pointer, stack pointer, the works — lives in a pt_regs structure. Redirect those registers before the thread returns, and you control what Firecracker executes next.
The attack chain started by placing a nonce in a guest page, then using the host memory primitive to scan for EPT (Extended Page Table) roots and walk the nested page tables until the host physical address of that page was confirmed. From there, the researchers located the Firecracker process, identified the live vCPU thread, and found its saved register frame. A guest operation that triggered a KVM_RUN return provided the execution moment. The team modified the saved registers, pointed execution at a chosen call, and triggered the return. Host root shell obtained. The guest never crashed.
The vulnerability is tracked as CVE-2026-99999. No patch status was mentioned in this post.