CVE-2026-122192
Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with root privileges to read or modify Firecracker VMM process memory via balloon or virtio-mem discard requests on microVMs restored from a snapshot with the File memory backend, if the host fails to create the replacement mapping. To remediate this issue, users should upgrade to Firecracker 1.16.2 or 1.17.0 and later.
Am I affected?
Sign in and add the software you use to your watchlist: we check it against every new vulnerability.
Show me how to fix itTimeline
- First covered by RedTeamDaily
- Published by NVD
- Last updated by NVD
Coverage
AWS warns of Firecracker flaw CVE-2026-122192 allowing guest root access to VMM memory
AWS has published bulletin 2026-169-AWS for CVE-2026-122192, affecting Firecracker v0.23.0 through v1.16.1 inclusive. Under certain host memory conditions, a root user in a guest can read or modify memory of the Firecracker process. The issue affects VMs restored from a snapshot that use the File memory backend with a balloon or virtio-mem device.
Sources: NVD and CISA known exploited vulnerabilities catalogue.