The Copy.fail and DirtyFrag vulnerabilities (including CVE-2026-31431, CVE-2026-43284, CVE-2026-46300, and others) are local privilege escalation issues affecting Linux Kernel modules such as algif_aead, xfrm_user, esp4, esp6, and espintcp. These vulnerabilities allow a local attacker to escalate privileges on affected Linux kernels. AWS has identified affected kernel versions across Amazon Linux, Bottlerocket, and other AWS services. AWS has released patches for Amazon Linux kernels (versions 4.14 through 6.18), Bottlerocket (v1.61.0 and later), ECS, EKS-optimized AMIs, and AWS Deep Learning AMIs. Patching timelines for EMR and Fargate are provided, with updates expected by late May 2026. SageMaker environments are being patched automatically or require customer restarts to apply patched kernels. AWS recommends customers apply all available updates as soon as possible. The bulletin is actively maintained with ongoing updates.

Successful exploitation of these vulnerabilities could allow a local attacker to escalate privileges on affected Linux Kernel environments, potentially gaining unauthorized administrative access. This impacts a wide range of AWS services and Linux distributions used within AWS. No known exploits in the wild have been reported. The vulnerabilities affect kernel modules critical to system security, making timely patching important to prevent privilege escalation risks.

AWS has released official patches for affected Amazon Linux kernels, Bottlerocket, ECS, EKS, AWS Deep Learning AMIs, and SageMaker environments. Customers should apply all available updates immediately to their environments. For EMR and Fargate, AWS has provided patch release timelines and recommends applying updates once available. SageMaker notebook instances and other resources require restarts to pick up patched kernels. AWS manages patching for Fargate and ECS managed instances, requiring no customer action. Customers should monitor the AWS Security Bulletin (ID: 2026-030-AWS) for ongoing updates and apply patches promptly as they are released.