AWS AMI 2026-04-30

The EC2 scope AMIs null-runtime-84 (x86) and null-runtime-arm-15 (arm64) mitigate CVE-2026-31431, a Linux kernel flaw that lets any local user gain root.

Action required

The previous AMIs are affected by CVE-2026-31431. Move your EC2 scopes to the new AMIs and redeploy them.

Fixes

• CVE-2026-31431. A logic flaw in the kernel's authencesn code, reachable through an AF_ALG socket and splice(), allows an unprivileged local user to become root. The AMIs now disable the algif_aead kernel module, which blocks that path. This is a mitigation: the kernel fix itself will ship in a later AMI once it is available in Ubuntu.

GPU AMIs were not rebuilt in this release.

Upgrade

The AMIs are shared with your AWS account. Find them by name (null-runtime-84 and null-runtime-arm-15), set their IDs in ami.id of your EC2 provider, and redeploy your scopes. Each scope keeps running the previous AMI until it's redeployed. To track that rollout, see AMI drift detection.