CVE-2026-122192: Guest Access to Firecracker Process Memory After a Failed Memory Discard

Aws.Amazon • November 4, 2026

Bulletin ID: 2026-169-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/04/2026 11:30 AM PST

Firecracker is an open source virtualization technology that powers AWS Lambda and other serverless compute services. We identified CVE-2026-122192 , an issue in Firecracker v0.23.0 through v1.16.1 that, under certain host memory conditions, can let a root user in a guest read or modify memory of the Firecracker process. It affects VMs restored from a snapshot using the File memory backend with a balloon or virtio-mem device.

AWS services including AWS Lambda are not affected by this issue. No customer action is required.

Impacted versions: Firecracker v0.23.0 through v1.16.1, inclusive.

Within the currently supported release lines, v1.16.0 and v1.16.1 are affected. The fix is included in v1.16.2 and v1.17.0

This issue is fixed in Firecracker v1.16.2 and v1.17.0 . If you restore VMs using the File memory backend with a balloon or virtio-mem device, we recommend upgrading to Firecracker v1.16.2, v1.17.0 or later. Operators maintaining forks or derivative code should incorporate the corresponding fixes.

If upgrading is not immediately possible, restore snapshots using the Uffd memory backend, following its documented requirements for handling discarded pages .

The following measures address known host-memory failure conditions:

On kernels without the Linux 6.12 overcommit-handling change, use heuristic overcommit (vm.overcommit_memory=0) and keep the maximum discard size no greater than the host’s total RAM plus swap.

Keep the memory cgroup’s out-of-memory (OOM) killer enabled.

These measures do not prevent every replacement-mapping failure.

We thank Juan Pablo Martinez Kuhn from Coinspect for collaborating on this issue through the coordinated vulnerability disclosure process.

Please email [email protected] with any security questions or concerns.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AWS Firecracker Vulnerability CVE-2026-122192 Exposes Memory to Guest Users CVE-2026-122192 affects Firecracker versions 0.23.0 to 1.16.1, allowing root users in a guest VM to read or modify the Firecracker process memory under certain conditions. This vulnerability arises when a microVM is restored from a snapshot using the File memory backend, leading to a failure in memory remapping. The issue does not affect AWS services like AWS Lambda. AWS has released patches in versions 1.16.2 and 1.17.0 to mitigate this vulnerability. Operators are advised to upgrade or use alternative memory backends if immediate upgrades are not feasible. The vulnerability was disclosed on November 4, 2026, with a CVSS score of 7.5, indicating a high severity level. The research was conducted by Coinspect, who coordinated with AWS on the disclosure. 2 sources 57

Extracted Entities

CVE-2026-122192: Guest Access to Firecracker Process Memory After a Failed Memory Discard

The full story

Extracted Entities

CVEs (1)

Email Addresses (1)

Platforms (1)

Tools (1)