> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Aviatrix Controller 10.1.21 Release Notes

> Release Date: 5 November 2026

Release Date: 5 November 2026

> [!WARNING]
>
> **Upgrade guidance for this security fix release**: This release applies a mitigation for a Linux kernel vulnerability (CVE-2026-98432) on gateways. The Controller
> receives the kernel fix through operating system updates, so you do not need
> to upgrade the Aviatrix software first. The fix takes effect only after you
> reboot the Controller, so check the Controller kernel version and reboot the
> Controller as soon as you can. Gateways running 8.1.x or later are mitigated shortly after the Controller is upgraded. When you have a maintenance window, upgrade
> the Controller to 10.1.21, and then upgrade the gateways to 10.1.21. For how to check
> the kernel version and the fixed versions, see the [PSIRT Advisories](https://docs.aviatrix.com/docs/enterprise/9.0/reference/release-notices/psirt-advisories/index.md#cve-2026-98432-linux-kernel-tcp-vulnerability).

## Corrected Issues in Aviatrix Release 10.1.21

This release applies a mitigation for the following CVE advisory, detailed on the [PSIRT Advisories](https://docs.aviatrix.com/docs/enterprise/9.0/reference/release-notices/psirt-advisories/index.md#cve-2026-98432-linux-kernel-tcp-vulnerability) page:

* [CVE-2026-98432](https://nvd.nist.gov/vuln/detail/CVE-2026-98432): Linux kernel IPv4 TCP race condition.

## Known Issues in Aviatrix Release 10.1.21

<table>
  <thead><tr><th>Issue</th><th>Description</th></tr></thead>

  <tbody>
    <tr><td>AVX-80977</td><td>A VPN user's profile assignment could appear as N/A immediately after the user was attached to a profile through the API, until the user's next reconnection.\
    \
    **Impact:**\
    \
    <ul><li>The user's profile displays as N/A until the user's next reconnection, even though the profile attachment succeeded.</li><li>This can cause confusion when auditing or verifying profile-based access policies shortly after attachment.</li></ul>**Workaround:**\
    \
    Have the affected user reconnect to update the displayed profile assignment. Contact [Aviatrix Support](https://support.aviatrix.com/) for assistance.</td></tr>
    <tr><td>AVX-81230</td><td>Enabling both Policy-Based Routing (PBR) and NAT logging under User VPN settings can cause high CPU utilization on the User VPN gateway during data-plane traffic. The high CPU usage occurs because NAT log entries generated by PBR are written to the gateway's serial console.\
    \
    **Impact:**\
    \
    User VPN gateways with both PBR and NAT logging enabled may experience elevated CPU utilization while passing data-plane traffic, which can degrade VPN gateway performance.\
    \
    **Workaround:**\
    \
    Disable NAT logging on the affected User VPN gateway. If NAT logging must remain enabled, contact [Aviatrix Support](https://support.aviatrix.com/) to apply a backend workaround.</td></tr>
    <tr><td>AVX-81576</td><td>**Description:** During a Gateway resize operation (for example, changing the Gateway's underlying instance or VM size), the Gateway can experience a temporary period of traffic loss during the resize. This has been observed during testing on GCP, AWS, and Azure Gateways, where a resize between certain instance sizes produced approximately 2 minutes of packet loss.\
    \
    **Impact:**<ul><li>A Gateway resize can result in a brief traffic interruption, observed at approximately 2 minutes in testing.</li><li>This has been confirmed to occur on GCP, AWS, and Azure Gateways.</li></ul>**Workaround:**\
    \
    No workaround is currently available. A fix is planned for a future 10.1.x maintenance release.</td></tr>
    <tr><td>AVX-81949</td><td>After a gateway software rollback, a small subset of HA gateways may incorrectly display the previous software version as the same value as the current software version, instead of the pre-rollback version.\
    \
    **Impact:**<ul><li>Affects the reported **Previous Version** on HA gateways after a Gateway Software Rollback.</li><li>The rollback itself completes successfully and the gateway runs on the intended target version; only the version display is affected.</li><li>Other gateways in the same rollback operation display the previous and current versions correctly.</li></ul>**Workaround:**\
    \
    No functional workaround is required. The rollback operation is successful despite the display discrepancy. Contact [Aviatrix Support](https://support.aviatrix.com/) for assistance.</td></tr>
  </tbody>
</table>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.
Issue	Description
AVX-80977	A VPN user's profile assignment could appear as N/A immediately after the user was attached to a profile through the API, until the user's next reconnection.\ \ Impact:\ \ The user's profile displays as N/A until the user's next reconnection, even though the profile attachment succeeded. This can cause confusion when auditing or verifying profile-based access policies shortly after attachment. Workaround:\ \ Have the affected user reconnect to update the displayed profile assignment. Contact [Aviatrix Support](https://support.aviatrix.com/) for assistance.
AVX-81230	Enabling both Policy-Based Routing (PBR) and NAT logging under User VPN settings can cause high CPU utilization on the User VPN gateway during data-plane traffic. The high CPU usage occurs because NAT log entries generated by PBR are written to the gateway's serial console.\ \ Impact:\ \ User VPN gateways with both PBR and NAT logging enabled may experience elevated CPU utilization while passing data-plane traffic, which can degrade VPN gateway performance.\ \ Workaround:\ \ Disable NAT logging on the affected User VPN gateway. If NAT logging must remain enabled, contact [Aviatrix Support](https://support.aviatrix.com/) to apply a backend workaround.
AVX-81576	Description: During a Gateway resize operation (for example, changing the Gateway's underlying instance or VM size), the Gateway can experience a temporary period of traffic loss during the resize. This has been observed during testing on GCP, AWS, and Azure Gateways, where a resize between certain instance sizes produced approximately 2 minutes of packet loss.\ \ Impact: A Gateway resize can result in a brief traffic interruption, observed at approximately 2 minutes in testing. This has been confirmed to occur on GCP, AWS, and Azure Gateways. Workaround:\ \ No workaround is currently available. A fix is planned for a future 10.1.x maintenance release.
AVX-81949	After a gateway software rollback, a small subset of HA gateways may incorrectly display the previous software version as the same value as the current software version, instead of the pre-rollback version.\ \ Impact: Affects the reported Previous Version on HA gateways after a Gateway Software Rollback. The rollback itself completes successfully and the gateway runs on the intended target version; only the version display is affected. Other gateways in the same rollback operation display the previous and current versions correctly. Workaround:\ \ No functional workaround is required. The rollback operation is successful despite the display discrepancy. Contact [Aviatrix Support](https://support.aviatrix.com/) for assistance.