AWS has identified a class of Linux Kernel privilege escalation vulnerabilities collectively known as Copy.fail or DirtyFrag, affecting kernel modules such as espintcp, xfrm_user, esp4, esp6, and algif_aead. Multiple CVEs are associated with these issues, including CVE-2026-46300, CVE-2026-43284, and CVE-2026-31431. Affected AWS services include Amazon Linux kernels (versions 4.14, 5.4, 5.10, 5.15, 6.1, 6.12, and 6.18), Bottlerocket, ECS, EKS, EMR, Fargate, AWS Deep Learning AMIs, and SageMaker. AWS has released patches and updates for these services and recommends customers apply them as soon as possible. Some services are patched automatically or require minimal customer action such as restarting instances or notebooks. The bulletin remains active with ongoing updates.

Successful exploitation of these vulnerabilities could allow local privilege escalation on affected Linux Kernel modules, potentially enabling attackers to gain elevated privileges on impacted systems. This affects multiple AWS services and Linux distributions used within AWS environments. The impact is significant given the scope of affected kernel modules and the broad range of AWS services involved.

AWS has released official patches and updates for all affected services and Linux kernel versions. Customers should apply all available updates to Amazon Linux kernels, Bottlerocket hosts, ECS, EKS, EMR, Fargate, AWS Deep Learning AMIs, and SageMaker resources promptly. For managed services like Fargate and SageMaker, many patches are applied automatically; customers should restart affected instances, notebooks, or applications as instructed to ensure patched kernels are in use. AWS continues to update the bulletin with new patching timelines and guidance. Customers should monitor the AWS Security Bulletin (ID: 2026-030-AWS) for ongoing updates and apply patches as soon as they are available.