Amazon Linux 2027 (AL2027) preview version 2027.0.20260928 release notes

• On-premises images are now available in the AL2027 public preview. You can download images in VMware OVA, KVM/QEMU qcow2, Hyper-V VHDx, and raw formats from https://cdn-al2027.amazonlinux.com/os-images/latest/ to run AL2027 on your own virtualization platforms.

  As with all preview components, these images are pre-release, aren't covered by AWS Support, and should be used only for evaluation and validation, not production. For production workloads, continue to run AL2023 until AL2027 reaches general availability.

• AL2027 now ships NVIDIA repositories, which include the NVIDIA Linux GPU driver and CUDA. AL2027 will add more NVIDIA packages to these repositories in future releases. For more information, see NVIDIA drivers.

Notable updates

• By default, we reduce the scope of ptrace for processes to their own sub-processes only. kernel.yama.ptrace_scope now defaults to 1 by removing the hard requirement on elfutils-default-yama-scope in the elfutils-libs package. Developer and debugging tools that need unrestricted ptrace can install the opt-in enabler package elfutils-yama-ptrace-enable. This package also provides default-yama-scope for backward compatibility.

• The mariadb1011, mariadb114, mariadb118, mariadb123, and mariadb-connector-c packages are now built against AWS-LC instead of OpenSSL.

• Starting with kernel version kernel7.2-7.2.4-4.107.amzn2027, AL2027 ships kernel modules in zstd-compressed format with a .ko.zst file extension, instead of the previous uncompressed .ko format. The kernel decompresses modules at load time. We recommend that you test any workloads that use kernel modules on this kernel and switch to compression-agnostic tooling such as modprobe. This is included in the kmod-34.2-2.amzn2027.0.1 release.

Security updates

• For information on the CVEs addressed in this release, see the Amazon Linux Security Center (ALAS).

• For visibility into the status of CVEs that haven't been addressed yet, see the Amazon Linux Security Center CVE Explorer.

Known issues

• The NVIDIA repositories do not yet support repository metadata signing. Signing support will be added in an upcoming release. For more information, see Repository metadata signing in AL2027.

• The systemtap package does not function on kernel 7.2 because of a kernel function signature change. If you need to use systemtap, remain on kernel 7.1. This issue will be fixed in the next release, which updates systemtap to version 5.6.