AWS Updates Amazon Linux Hosts for KVM Virtio-Net Vulnerability
Tech GuruQuick Answer
AWS published 2026-137-AWS for CVE-2026-99999 affecting self-managed KVM hosts that use virtio-net or TAP on unpatched Linux kernels 4.4 through 6.18. Patch from the supported distribution, reboot each host, verify the running kernel and workloads, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory self-managed KVM and Firecracker hosts, their running kernels, guest privilege boundaries, and virtio-net or TAP use; migrate or stop guests under change control; install the supported fixed kernel; reboot; and verify the running kernel and guest networking.
Last verified: 2026-10-16 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | self-managed KVM hypervisors using virtio-net or TAP on Linux kernel 4.4 through 6.18 |
|---|---|
| Advisory | 2026-137-AWS |
| CVE | CVE-2026-99999 |
| Authoritative release date | 2026-10-15 17:30:00 UTC |
| Authority revision date | 2026-10-15 17:30:00 UTC |
| Affected versions | Self-managed virtual-machine hosts using virtio-net and KVM, including Firecracker, on unpatched Linux kernels 4.4 through 6.18. AWS-managed EC2 instances, Lambda, and Fargate are not affected. |
| Fixed version | the advisory-listed Amazon Linux 2 or Amazon Linux 2023 kernel package, or the supported fixed kernel from another Linux distributor, followed by a host reboot |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
AWS disclosed a virtio-net and TAP path issue through which a privileged guest actor could corrupt KVM host-kernel memory, with possible disclosure or denial of service. Amazon Linux kernel packages are available and no workaround is listed.
What To Validate Now
- Inventory. Locate self-managed KVM hypervisors using virtio-net or TAP on Linux kernel 4.4 through 6.18 deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: Self-managed virtual-machine hosts using virtio-net and KVM, including Firecracker, on unpatched Linux kernels 4.4 through 6.18. AWS-managed EC2 instances, Lambda, and Fargate are not affected. Do not infer applicability from product family or severity alone.
- Remediate. Apply the advisory-listed Amazon Linux 2 or Amazon Linux 2023 kernel package, or the supported fixed kernel from another Linux distributor, followed by a host reboot through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the resulting version or managed-service state, exercise representative functionality and recovery paths, monitor for regressions, and document exceptions.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
AWS-managed EC2 instances, Lambda, and Fargate are outside the stated affected scope. A package installation without the required host reboot does not load the fixed kernel, and AWS lists no workaround. Preserve the authority snapshot, asset and owner records, before-and-after versions, change approval, installation output, validation results, exceptions, and rollback evidence.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
