Skip to main content

Issue in the Linux kernel virtio-net/TAP networking path affecting KVM-based hypervisors

Bulletin ID: 2026-137-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/15/2026 10:30 AM PDT

Description:

AWS is aware of an issue in the Linux kernel's virtio-net/TAP networking path (CVE-2026-99999) that affects KVM-based hypervisors running unpatched Linux kernel versions 4.4 through 6.18. This issue could allow an actor with privileged access inside a guest virtual machine to send specially crafted network packets that corrupt host kernel memory that could result in disclosure of host memory or a denial of service.

AWS-managed compute and container services, including Amazon EC2 instances, AWS Lambda, and AWS Fargate, are not affected. There is no action required for customers using these services.

Affected products & versions:

Customers who self-manage virtual machines using virtio-net and KVM, including those using virtual machine monitors such as Firecracker, on hosts running affected, unpatched Linux kernel versions.

Resolution:

Amazon Linux released updated kernel packages that address this issue. For details, see Amazon Linux Security Advisory. The following kernel versions, or later, include the fix:

AWS recommends that customers who self-manage virtual machines using virtio-net and KVM on Amazon Linux apply the updated kernel packages to their host systems and reboot. For guidance on updating Amazon Linux 2023, see Manage package and operating system updates in AL2023. For guidance on updating Amazon Linux 2, see Update instance software on your AL2 instance. Customers using other Linux distributions should apply kernel updates from their operating system vendor.

Workarounds:

There are no workarounds for this issue. To address it, apply the updated kernel packages listed above.

References:

Acknowledgement:

We would like to thank Paulos Yibelo of pwn.ai for collaborating on this issue through the coordinated disclosure process.


Please email aws-security@amazon.com with any security questions or concerns.