Bulletin ID: 2026-169-AWS
Publication Date: 11/04/2026 11:30 AM PST
Description:
We identified CVE-2026-122192, an issue in Firecracker v0.23.0 through v1.16.1 that, under certain host memory conditions, can let a root user in a guest read or modify memory of the Firecracker process. It affects VMs restored from a snapshot using the File memory backend with a balloon or virtio-mem device.
Impacted versions: Firecracker v0.23.0 through v1.16.1, inclusive.
Refer to the article below for the most up-to-date and complete information.
This article has been indexed from Latest Bulletins
Read the original article:
CVE-2026-122192 – Guest Access to Firecracker Process Memory After a Failed Memory Discard