Firecracker failed memory remap lets guest root access VMM memory

Summary

Improper handling of a failed memory remap lets a root user inside a guest read or modify Firecracker VMM process memory. microVMs restored from a snapshot with the File memory backend are affected.

Affected when

• microVMs restored from a snapshot
• File memory backend
• guest user with root privileges
• host fails to create the replacement mapping

What to do

Update to Firecracker 1.16.2 or 1.17.0 and later.

Update to at least the version for your product:

• Firecracker 1.16 line 1.16.2 or later
• Firecracker 1.17 line 1.17.0 or later

Products and platforms

• Linux
• firecracker

CVE IDs

• CVE-2026-122192 (opens in a new tab)

Sources

• Advisory: github.com (opens in a new tab) · github.com (opens in a new tab) · aws.amazon.com (opens in a new tab)
• Write-up: github.com (opens in a new tab)
• CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-04 19:35 UTC

First seen 2026-11-09 16:00 UTC