AWS Security Bulletin 2026-137-AWS (CVE-2026-99999) Does Not Affect Standard EC2 Instances: A Look at the Scope of Impact
This page has been translated by machine translation. View original
Introduction
AWS published AWS Security Bulletin 2026-137-AWS regarding the Linux kernel on October 15, 2026.
This article introduces the impact of CVE-2026-99999 on EC2 and how to apply fixes when the KVM host is running Amazon Linux 2 / 2023.
Bulletin Contents
The bulletin addresses an issue in the virtio-net/TAP path of the Linux kernel. When a privileged user inside a guest VM sends a crafted packet, the KVM host's kernel memory can be corrupted, potentially leading to host memory leakage or DoS.
EC2, Lambda, and Fargate are out of scope and no action is required for them. The bulletin targets hosts that self-manage VMs using virtio-net and KVM. This also includes cases where VMs are run using a VMM such as Firecracker. In the CVE record on cve.org, the CVSS score is 9.3.
AWS states that there is no workaround, and that affected parties must apply a patched kernel.
Checking Whether You Are Affected
The key question is whether you are operating a KVM host yourself.
If you are simply running applications on a regular EC2 instance, the host is under AWS management and is therefore out of scope.
On the other hand, if you run KVM on EC2 with nested virtualization enabled, that instance becomes the KVM host. According to the nested virtualization user guide, AWS is responsible for isolation between EC2 instances via the Nitro System. Protection of the OS, hypervisor, nested VMs, and their contents is the responsibility of the user.
The following article introduces the steps for enabling nested virtualization on EC2 and setting up a KVM host.
If you run a VM infrastructure on bare metal instances such as c8i.metal-48xl or c8i.metal-96xl, those instances are also KVM hosts.
How to Fix
If the KVM host OS is Amazon Linux 2 or Amazon Linux 2023, follow the update guide for each OS to apply the latest packages including the patched kernel.
Operating Systems Other Than Amazon Linux
For operating systems other than Amazon Linux, check the status of fix availability on each vendor's response page, and apply the fix if it is available.
Summary
CVE-2026-99999 is a critical vulnerability with a CVSS score of 9.3. However, the bulletin identifies the affected parties as hosts that self-manage VMs using virtio-net and KVM. Specifically, this applies to cases where KVM is run on EC2 with nested virtualization enabled, or where a VM infrastructure is run on bare metal instances.
In environments where privileges are granted to guest VM users, prioritize applying the patched kernel.
