Issue in the Linux kernel virtio-net/TAP networking path affecting KVM-based hypervisors

CVE-2026-99999 is a vulnerability in the Linux kernel's virtio-net/TAP networking path impacting KVM-based hypervisors with unpatched Linux kernel versions from 4.4 up to and including 6.18. An attacker with privileged access inside a guest VM can exploit this flaw by sending crafted network packets that corrupt host kernel memory. This corruption can lead to disclosure of host memory or cause a denial of service condition on the host. AWS-managed services such as EC2, Lambda, and Fargate are not affected by this issue. The vulnerability specifically affects self-managed virtual machines using virtio-net and KVM on hosts running the vulnerable kernel versions.

The vulnerability allows a privileged guest VM user to corrupt host kernel memory, which can result in unauthorized disclosure of host memory contents or cause a denial of service on the host system. This compromises the isolation between guest and host, potentially exposing sensitive host data or disrupting host operations.

AWS-managed compute and container services are not affected, and no action is required for customers using these services. For customers self-managing virtual machines with virtio-net and KVM on affected Linux kernel versions (4.4 through 6.18), remediation involves applying vendor patches to update the Linux kernel to a fixed version. Patch status is not yet confirmed in this bulletin; customers should consult their Linux distribution vendor advisories for official fixes and apply them promptly.