---
title: AWS AMI 2026-04-30
date: 2026-04-30T00:00:00.000Z
slug: ami-2026-04-30
tags:
  - release
  - ami
description: >-
  New EC2 scope AMIs (null-runtime-84 and null-runtime-arm-15) that mitigate the
  CVE-2026-31431 Linux kernel privilege escalation.
canonical: 'https://docs.nullplatform.com/changelog/ami-2026-04-30'
---
The EC2 scope AMIs `null-runtime-84` (x86) and `null-runtime-arm-15` (arm64) mitigate CVE-2026-31431, a Linux kernel flaw that lets any local user gain root.

:::warning Action required
The previous AMIs are affected by CVE-2026-31431. Move your EC2 scopes to the new AMIs and redeploy them.
:::

## Fixes

- **CVE-2026-31431.** A logic flaw in the kernel's `authencesn` code, reachable through an `AF_ALG` socket and `splice()`, allows an unprivileged local user to become root. The AMIs now disable the `algif_aead` kernel module, which blocks that path. This is a mitigation: the kernel fix itself will ship in a later AMI once it is available in Ubuntu.

GPU AMIs were not rebuilt in this release.

## Upgrade

The AMIs are shared with your AWS account. Find them by name (`null-runtime-84` and `null-runtime-arm-15`), set their IDs in `ami.id` of your [EC2 provider](/docs/providers/supported-integrations/compute-management/ec2-configuration), and redeploy your scopes. Each scope keeps running the previous AMI until it's redeployed. To track that rollout, see [AMI drift detection](/docs/tutorials/ami-drift).