Firecracker: failed memory remap lets a guest root user read or modify VMM process memory

Impact

On a microVM restored from a snapshot with the File memory backend, a balloon or virtio-mem discard request that fails to recreate its replacement mapping can leave the guest with a view into the Firecracker VMM process's own memory, readable and writable. That is a guest-to-VMM boundary crossing: on a multi-tenant node running many microVMs per host, the VMM process holds the state that keeps one tenant's VM separate from the device backends and the host. GPU and accelerator fleets that use Firecracker for per-tenant sandboxes around inference or agent code are exposed wherever snapshot restore with the File backend is in use. Exploitation needs root inside the guest and depends on a host allocation failure, so it is not a reliable primitive, but the consequence is full read/write of VMM memory.

Who can reach it

A local user with root privileges inside a Firecracker guest, on a microVM restored from a snapshot using the File memory backend. No host credentials needed; the guest must be able to issue balloon or virtio-mem discard requests and the host must fail to create the replacement mapping.

What to do

Upgrade Firecracker to 1.16.2 or 1.17.0 or later; affected range is 0.23.0 through 1.16.1. The binary is per-VM, so rolling it out means replacing it and restarting or re-launching each microVM - running guests keep the old VMM. No host reboot required.

References

Related entries

• PackageKit dnf5 backend: an unprivileged local user can uninstall packages under a simulate flagCVE-2026-19816 · PackageKit dnf5 backend (RepoRemove polkit bypass)High
• Linux arm64: SVE signal-context restore can leave a task invalid and read out of boundsCVE-2026-23102 · Linux kernel arm64 FPSIMD/SVE signal handling (SVE context restore with SME present)High
• Linux kernel NVMe: userspace num_keys drives a multi-megabyte kzalloc in nvme_pr_read_keys()CVE-2026-23244 · Linux kernel NVMe host (nvme_pr_read_keys persistent-reservation ioctl)High
• Linux kernel CXL mailbox: undersized raw command payload read out of boundsCVE-2026-23327 · Linux kernel CXL core mailbox (cxl_payload_from_user_allowed)High
• Linux kernel (drivers/pci/controller/dwc): Raising an MSI-X interrupt is a posted PCI write, and the endpoint driverCVE-2026-23361 · Linux kernel (drivers/pci/controller/dwc)High
• Linux nvme-pci: slab out-of-bounds read in nvme_dbbuf_set during controller resetCVE-2026-43449 · Linux kernel nvme-pci driver (nvme_dbbuf_set doorbell buffer loop)High