$1 Million Sandbox Challenge Uncovers Linux Kernel Flaws
Source SecurityWeek
Rated by Threat Radar
Data as of 15 Sep 2026, 16:01 UTC
What to do
AI-suggested
Fixes for the Linux kernel vulnerabilities are currently under private review with CVEs pending. Vercel and kernel maintainers are coordinating to release official patches. Until public patches are available, users should monitor vendor advisories for updates. Vercel has already improved its sandbox security based on the findings. The vendor also recommends architectural best practices such as not trusting guest inputs crossing the microVM boundary and deriving sensitive values server-side or signing them with keys inaccessible to guests. Automated AI-assisted triage tools can help manage large volumes of vulnerability reports efficiently.
Description
A $1 million bug bounty challenge by Vercel uncovered multiple vulnerabilities in the Linux kernel's networking stack used in their Firecracker-based microVM sandbox environment. The challenge generated 1,285 reports over two weeks, identifying one critical and several high- and medium-severity issues. Notably, two independent Linux kernel flaws were found: one causing memory leaks and another causing deterministic host crashes. These vulnerabilities have broad implications for cloud providers using similar Linux kernel isolation techniques. No customer data was accessed during the challenge. Fixes are under private review with CVEs pending. Vercel automated report triage using AI to handle the high volume of submissions and improved their sandbox security based on findings.