CVE-2026-122266 - Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS
CVE-2026-122266
Summary
Bulletin ID: 2026-169-AWS
Publication Date: 11/04/2026 11:30 AM PST
Description:
We identified CVE-2026-122192, an issue in Firecracker v0.23.0 through v1.16.1 that, under certain host memory conditions, can let a root user in a guest read or modify memory of the Firecracker process. It affects VMs restored from a snapshot using the File memory backend with a balloon or virtio-mem device.
Impacted versions: Firecracker v0.23.0 through v1.16.1, inclusive.
Refer to the article below for the most up-to-date and complete information.
Read this article
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 1
Updates
- Published by AWS
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.