Dirty Frag and other issues in Amazon Linux kernels

unknownknown exploitedpublic exploitCVE-2026-31431

Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.

Bulletin ID: 2026-027-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/05/07 19:45 PM PDT Description: Amazon is aware of a class of issues in the Linux kernel related to the original issue (CVE-2026-31431). The issues commonly referred to as "DirtyFrag" are present in a number of loadable modules, including xfrm_user/esp4/esp6 and ipcomp4/ipcomp6. On systems that allow unprivileged users to create sockets directly or through CAP_NET_ADMIN, or allow the creation of unprivileged user namespaces (user+net), an actor may gain access to kernel memory and thus escalate their privileges. Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

CSIRTS triage

vendor: AWS product: Linux kernel Privilege escalation

What: Issues related to the original privilege escalation issue in the Linux kernel.
Who is affected: AWS customers using the affected Linux kernel.
Urgency: Remediation is urgent due to the potential for exploitation.
Action: Refer to the article for the most up-to-date information and apply necessary updates.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Linux kernel

Get an email when a new Linux kernel advisory drops — max one per day, one-click unsubscribe.

Details

Source: AWS Security Bulletins (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-08-20
Exploitation: Observed in the wild (CISA KEV)

Original advisory: https://aws.amazon.com/security/security-bulletins/rss/2026-027-aws/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Exploitation confirmedCVE-2026-31431Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 99.9% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-31431	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

highexploited[UPDATE] [high] Linux Kernel: Multiple vulnerabilitiescert-bund
unknownexploitedLSN-0121-1: Kernel Live Patch Security Noticeubuntu
unknownexploitedCVE-2026-31431aws
unknownexploitedOngoing updates on Copy.fail and variantsaws
unknownexploitedMultiple vulnerabilities in SUSE Linux kernel (August 14, 2026)cert-fr-avis
highexploited[UPDATE] [high] Linux Kernel (Dirty Frag): Multiple vulnerabilities allow gaining administrator rightscert-bund
highexploitedCVE-2026-31431: crypto: algif_aead - Revert to operating out-of-placemsrc
high[UPDATE] [high] IBM QRadar SIEM: Multiple vulnerabilitiescert-bund
unknownexploitedSiemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFPcisa
high[NEW] [high] Oracle Communications: Multiple vulnerabilitiescert-bund
criticalexploitedABB Ability Edgeniuscisa
unknownexploitedUSN-8528-1: Linux kernel (Xilinx ZynqMP) vulnerabilitiesubuntu

Recent advisories for Dirty Frag and

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highexploited[UPDATE] [high] Linux Kernel (Dirty Frag): Multiple vulnerabilities allow gaining administrator rightscert-bund · 2026-08-07
unknownLinux Kernel vulnerability Dirty Fragfortinet · 2026-06-03

Dirty Frag and other issues in Amazon Linux kernels

CSIRTS triage

Details

Exploitation outlook

Referenced CVEs

Same CVEs, other sources

Recent advisories for Dirty Frag and

More from AWS Security Bulletins