CVE-2026-31431
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Bulletin ID: 2026-026-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/05/06 17:30 PM PDT Description: Amazon is aware of an issue in the Linux kernel (CVE-2026-31431) that could potentially allow an authenticated local user to escalate privileges. With the exception of the services listed below, AWS customers are not affected. See below for specific guidance on affected services. As a best practice, AWS recommends that you apply all security patches and software version updates as soon as they become available. Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
CSIRTS triage
- What
- An authenticated local user could potentially escalate privileges.
- Who is affected
- AWS customers using the affected Linux kernel.
- Urgency
- Remediation is urgent due to the potential for exploitation.
- Action
- Apply all security patches and software version updates as soon as they become available.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Linux kernel
Get an email when a new Linux kernel advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://aws.amazon.com/security/security-bulletins/rss/2026-026-aws/
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-31431Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 100% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-31431 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[UPDATE] [high] Linux Kernel: Multiple vulnerabilitiescert-bund
- high[UPDATE] [high] Linux Kernel (Dirty Frag): Multiple vulnerabilities allow gaining administrator rightscert-bund
- unknownexploitedUSN-8528-1: Linux kernel (Xilinx ZynqMP) vulnerabilitiesubuntu
- unknownMultiple vulnerabilities in Red Hat Linux kernel (July 3, 2026)cert-fr-avis
- unknownRedHat Linux Kernel Multiple Vulnerabilitieshkcert
- unknownMultiple vulnerabilities in the Ubuntu Linux kernel (June 26, 2026)cert-fr-avis
- criticalexploitedImpact of Linux Kernel vulnerabilities on B&R productscisa
- unknownOngoing updates on Copy.fail and variantsaws
- unknownexploitedDirty Frag and other issues in Amazon Linux kernelsaws
- unknownexploitedLinux Kernel Vulnerability copy.fail - CVE-2026-31431fortinet
- criticalexploitedCVE-2026-31431: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerabilitycisa-kev
- highexploited2026-005: High Vulnerability in the Linux Kernel ("Copy Fail")cert-eu
More from AWS Security Bulletins
- unknownCVE-2026-14904 - Improper Link Resolution in Auth.GetUserPrivateKey in AWS Research and Engineering Studio2026-07-07
- unknownCVE-2026-14471 - Authenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-…2026-07-06
- unknownCVE-2026-14265- Deserialization of Untrusted Data in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin2026-07-01
- unknownCVE-2026-13760 - OS Command Injection in NodejsFunction Docker Bundling in aws-cdk-lib2026-07-01
- unknownCVE-2026-13769 – Insecure file permissions in AWS CLI2026-07-01