Firecracker Sandbox Escape Chains Guest-to-VMM Code Execution With Seccomp Bypass

Coinspect demonstrated a two-stage Firecracker sandbox escape combining CVE-2026-122192, a guest-to-VMM memory-corruption vulnerability, with FC-03, an independent seccomp policy bypass. The first flaw affects versions 0.23.0 through 1.16.1 when restoring snapshots using the File memory backend with a balloon or virtio-mem device. A failed memory-remapping operation can leave KVM referencing stale host virtual addresses that Firecracker subsequently reuses for its own data, exposing live VMM process memory to malicious guest userspace. Researchers used this condition to achieve controlled code execution in the host-side Firecracker process.

FC-03 allows compromised VMM code to create an unrestricted io_uring instance and perform host operations blocked by direct system-call filtering, although process credentials, chroot, and namespace restrictions still apply. Coinspect demonstrated host-loopback communication and, by additionally exploiting Linux CVE-2026-43366, a host-kernel panic; it did not attempt host-kernel code execution. Operators of affected deployments should upgrade to 1.16.2 or 1.17.0 or later to fix the guest-to-VMM flaw; the proposed FC-03 redesign remains under review. AWS states that its services, including Lambda, are unaffected and require no customer action.