Skip to main content
Release Date: 5 November 2026
Upgrade guidance for this security fix release: This release applies a mitigation for a Linux kernel vulnerability (CVE-2026-98432) on gateways. The Controller receives the kernel fix through operating system updates, so you do not need to upgrade the Aviatrix software first. The fix takes effect only after you reboot the Controller, so check the Controller kernel version and reboot the Controller as soon as you can. Gateways running 8.1.x or later are mitigated shortly after the Controller is upgraded. When you have a maintenance window, upgrade the Controller to 10.1.21, and then upgrade the gateways to 10.1.21. For how to check the kernel version and the fixed versions, see the PSIRT Advisories.

​
Corrected Issues in Aviatrix Release 10.1.21

This release applies a mitigation for the following CVE advisory, detailed on the PSIRT Advisories page:

​
Known Issues in Aviatrix Release 10.1.21

IssueDescription
AVX-80977A VPN user’s profile assignment could appear as N/A immediately after the user was attached to a profile through the API, until the user’s next reconnection.

Impact:

  • The user’s profile displays as N/A until the user’s next reconnection, even though the profile attachment succeeded.
  • This can cause confusion when auditing or verifying profile-based access policies shortly after attachment.
Workaround:

Have the affected user reconnect to update the displayed profile assignment. Contact Aviatrix Support for assistance.
AVX-81230Enabling both Policy-Based Routing (PBR) and NAT logging under User VPN settings can cause high CPU utilization on the User VPN gateway during data-plane traffic. The high CPU usage occurs because NAT log entries generated by PBR are written to the gateway’s serial console.

Impact:

User VPN gateways with both PBR and NAT logging enabled may experience elevated CPU utilization while passing data-plane traffic, which can degrade VPN gateway performance.

Workaround:

Disable NAT logging on the affected User VPN gateway. If NAT logging must remain enabled, contact Aviatrix Support to apply a backend workaround.
AVX-81576Description: During a Gateway resize operation (for example, changing the Gateway’s underlying instance or VM size), the Gateway can experience a temporary period of traffic loss during the resize. This has been observed during testing on GCP, AWS, and Azure Gateways, where a resize between certain instance sizes produced approximately 2 minutes of packet loss.

Impact:
  • A Gateway resize can result in a brief traffic interruption, observed at approximately 2 minutes in testing.
  • This has been confirmed to occur on GCP, AWS, and Azure Gateways.
Workaround:

No workaround is currently available. A fix is planned for a future 10.1.x maintenance release.
AVX-81949After a gateway software rollback, a small subset of HA gateways may incorrectly display the previous software version as the same value as the current software version, instead of the pre-rollback version.

Impact:
  • Affects the reported Previous Version on HA gateways after a Gateway Software Rollback.
  • The rollback itself completes successfully and the gateway runs on the intended target version; only the version display is affected.
  • Other gateways in the same rollback operation display the previous and current versions correctly.
Workaround:

No functional workaround is required. The rollback operation is successful despite the display discrepancy. Contact Aviatrix Support for assistance.