CVE-2026-85028: AWS FPGA SDK LPE via insecure temp file in /net/common_functions.sh

CVE-2026-85028 Vulnerability Summary Vulnerability Overview Vulnerability Name: CVE-2026-85028: Insecure Directory Creation of Temporary Files in the AWS FPGA Development Kit Advisory ID: 2026-096-AWS Scope: AWS Severity: Important (warrants attention) Release Date: September 29, 2026, 11:00 AM PDT Description: The AWS FPGA Development Kit is a software-hardware development kit that helps developers create accelerators for the high-performance accelerator cards on EC2 F2 instances. We identified CVE-2026-85028, in which the FPGA management tools installer in versions prior to AWS FPGA Development Kit (aws-fpga) 2.3.4 may allow a local user to create a temporary file in a directory with root privileges. This directory is located in the shared directory . The installation step reads this file, thereby elevating its own privileges. Affected Scope Affected Versions: < 2.3.4 Resolution This issue has been fixed in AWS FPGA Development Kit version 2.3.4. The affected code wrote the function to . This file has been removed, and the SDK tools now read directly from . Recommendation: Upgrade to the latest version and ensure that any forks or derivative code have been patched to incorporate the new file. Specific Actions: Remove or comment out the lines referencing in and . Reference Links CVE-2026-85028 G45c-4c4e-wvmn-2x74 Acknowledgments Thanks to George Chen for collaborating through the coordinated vulnerability disclosure process to address this issue.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-85028: AWS FPGA SDK LPE via insecure temp file in /net/common_functions.sh

More from this source