AWS Security Bulletin Highlights Critical Linux Kernel Vulnerability for Self-Managed KVM Hosts

AWS has issued Security Bulletin 2026-137-AWS, detailing a critical vulnerability (CVE-2026-99999) in the Linux kernel's virtio-net/TAP networking path. This flaw specifically impacts KVM-based hypervisors running unpatched Linux kernel versions 4.4 through 6.18. The core issue is that a privileged user within a guest virtual machine could craft special network packets to corrupt the host kernel memory, potentially leading to disclosure of host memory or a denial of service. This vulnerability is significant for practitioners who operate self-managed virtual machines using virtio-net and KVM on AWS, including those leveraging bare metal instances for custom hypervisor deployments or nested virtualization scenarios. While AWS-managed compute services such as Amazon EC2 instances, AWS Lambda, and AWS Fargate are explicitly stated as *not* being affected, customers running their own KVM environments need to take immediate action. The CVSS score of 9.3 highlights the severe potential impact, demanding prompt attention to prevent exploitation. The broader trend in cloud security emphasizes shared responsibility, where AWS secures the underlying infrastructure, but customers are responsible for security *in* the cloud. This bulletin serves as a stark reminder of this model, particularly for those extending beyond standard managed services. As organizations push the boundaries of cloud flexibility with bare metal and nested virtualization, the responsibility for patching and maintaining the guest operating systems and hypervisors shifts more heavily to the customer. This aligns with the increasing need for robust vulnerability management and patching strategies in hybrid and multi-cloud environments, where the lines between infrastructure and application responsibility can blur. In practice, affected practitioners should prioritize applying the updated kernel packages to their host systems and rebooting. For those using Amazon Linux, specific guidance is available for Amazon Linux 2023 and Amazon Linux 2. Users of other Linux distributions must obtain kernel updates from their respective operating system vendors. There are no workarounds for this issue, making patching the only effective mitigation. This event underscores the importance of continuous monitoring for security bulletins, especially when operating custom or less-managed components within a cloud environment, and maintaining a clear understanding of the shared responsibility model for every service consumed.