Issue in the Linux kernel virtio-net/TAP networking path affecting KVM-based hypervisors
Bulletin ID: 2026-137-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/15/2026 10:30 AM PDT Description: AWS is aware of an issue in the Linux kernel's virtio-net/TAP networking path (CVE-2026-99999) that affects KVM-based hypervisors running unpatched Linux kernel versions 4.4 through 6.18. This issue could allow an actor with privileged access inside a guest virtual machine to send specially crafted network packets that corrupt host kernel memory that could result in disclosure of host memory or a denial of service. AWS-managed compute and container services, including Amazon EC2 instances, AWS Lambda, and AWS Fargate, are not affected. There is no action re
Read at AWS Security Bulletins
- Vendor
- Amazon Web Services, Linux kernel
- Product
- Linux kernel
- EPSS
- 0.008 (p56)
- Fix
- not yet available
- Exposure class
- Operating system
Why it ranks 31 (Notable)
- Product class: operating system
- Widely deployed vendor product (Amazon Web Services)
- Covered by 3 independent sources
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- AWS Security Bulletins (aws.amazon.com)
- CVE-2026-99999 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.