AWS sagemaker high security documentation change
Summary
Updated Amazon Linux 2 (AL2) notebook instance documentation with end-of-support timeline, added CVE vulnerability notice, migration instructions to AL2023, and maintenance plan details.
Security assessment
The change explicitly references CVE-2026-24747 security vulnerability in PyTorch that cannot be patched on AL2, warns about end of security updates after June 30, 2026, and urges migration to AL2023 for security maintenance.
Diff
diff --git a/sagemaker/latest/dg/nbi-al2.md b/sagemaker/latest/dg/nbi-al2.md index e671cc60f..69837d73b 100644 --- a//sagemaker/latest/dg/nbi-al2.md +++ b//sagemaker/latest/dg/nbi-al2.md @@ -7 +7 @@ -Supported instance typesAvailable KernelsAL1 Maintenance Phase Plan +Supported instance typesAvailable kernelsAL2 Maintenance Phase PlanAL1 Maintenance Phase Plan @@ -13 +13 @@ Supported instance typesAvailable KernelsAL1 Maintenance Phase Plan -JupyterLab 1 and JupyterLab 3 are no longer supported as of June 30, 2025. You can no longer create new or restart stopped notebook instances using these versions. Existing in-service instances may continue to function but will not receive security updates or bug fixes. Migrate to JupyterLab 4 notebook instances for continued support. For more information, see [JupyterLab version maintenance](./nbi-jl.html#nbi-jl-version-maintenance). +On June 30, 2026, Amazon Linux 2 reaches end of support for notebook instances. Existing in-service instances may continue to function but will not receive security updates or bug fixes. Starting July 1, 2026, you can no longer create new or restart stopped AL2 notebook instances. JupyterLab 1 and JupyterLab 3 have been deprecated since June 30, 2025. For more information, see [JupyterLab version maintenance](./nbi-jl.html#nbi-jl-version-maintenance). @@ -15 +15 @@ JupyterLab 1 and JupyterLab 3 are no longer supported as of June 30, 2025. You c -###### Note +Amazon Linux 2 is vulnerable to CVE-2026-24747, a security issue in PyTorch versions prior to 2.10.0 that cannot be patched on AL2 because of operating system constraints. @@ -17 +17 @@ JupyterLab 1 and JupyterLab 3 are no longer supported as of June 30, 2025. You c -AL2023 is the latest and recommended operating system available for notebook instances. To learn more, see [AL2023 notebook instances](./nbi-al2023.html). +As of May 15, 2026, `notebook-al2023-v1` is the default platform for all new notebook instances. We strongly recommend upgrading to AL2023 (`notebook-al2023-v1`) for continued support. To learn more, see [AL2023 notebook instances](./nbi-al2023.html). @@ -19 +19,12 @@ AL2023 is the latest and recommended operating system available for notebook ins -Amazon SageMaker notebook instances currently support Amazon Linux 2 (AL2) operating systems. You can select the operating system that your notebook instance is based on when you create the notebook instance. +Starting July 15, 2026, SageMaker AI will attempt to upgrade the following platforms to AL2023: + + * `notebook-al2-v1` (JupyterLab 1) + + * `notebook-al2-v2` (JupyterLab 3) + + * `notebook-al2-v3` (JupyterLab 4) + + + + +Amazon SageMaker notebook instances support Amazon Linux 2 (AL2) operating systems. Amazon Linux 2 is deprecated as of July 1, 2026. We recommend that you use AL2023 for all new notebook instances. @@ -27 +38 @@ SageMaker AI supports notebook instances based on the following Amazon Linux 2 o - * notebook-al2-v3: These notebook instances support JupyterLab version 4. For information about JupyterLab versions, see [JupyterLab versioning](./nbi-jl.html). + * notebook-al2-v3 (deprecating July 1, 2026): These notebook instances support JupyterLab version 4. As of May 15, 2026, AL2023 is the default platform for all new notebook instances. For information about JupyterLab versions, see [JupyterLab versioning](./nbi-jl.html). @@ -32 +43 @@ SageMaker AI supports notebook instances based on the following Amazon Linux 2 o -Notebook instances created before 08/18/2021 automatically run on Amazon Linux (AL1). Notebook instances based on AL1 entered a maintenance phase as of 12/01/2022 and are no longer available for new notebook instance creation as of 02/01/2023. To replace AL1, you now have the option to create Amazon SageMaker notebook instances with AL2. For more information, see AL1 Maintenance Phase Plan. +Notebook instances created before 08/18/2021 automatically run on Amazon Linux (AL1). Notebook instances based on AL1 entered a maintenance phase as of 12/01/2022 and are no longer available for new notebook instance creation as of 02/01/2023. To replace AL1, you now have the option to create Amazon SageMaker notebook instances with AL2023. For more information, see AL1 Maintenance Phase Plan. @@ -38 +49,3 @@ Notebook instances created before 08/18/2021 automatically run on Amazon Linux ( - * Available Kernels + * Available kernels + + * AL2 Maintenance Phase Plan @@ -49 +62 @@ Amazon Linux 2 supports instance types listed under **Notebook Instances** in [A -## Available Kernels +## Available kernels @@ -64,0 +78,54 @@ conda_tensorflow2_p310 | A conda environment that comes pre-installed with Tenso +## AL2 Maintenance Phase Plan + +The following table is a timeline for the Amazon Linux 2 end of support on notebook instances. + +Date | Description +---|--- +May 15, 2026 | The default platform identifier for new notebook instances changes from `notebook-al2-v3` to `notebook-al2023-v1`. +June 30, 2026 | AL2 reaches end of support. AL2 notebook instances no longer receive security updates or bug fixes. +July 1, 2026 | AL2 notebook instances can no longer be created or restarted. +July 15, 2026 | SageMaker AI will attempt to upgrade remaining AL2 instances to AL2023. + +### Migrating from Amazon Linux 2 to AL2023 + +If you have existing notebook instances running on Amazon Linux 2 (`notebook-al2-v1`, `notebook-al2-v2`, or `notebook-al2-v3`), migrate them to AL2023 before July 1, 2026. + +Migration is an in-place platform update. Your EBS volume data (notebooks, datasets, custom files in `/home/ec2-user/SageMaker/`) is preserved. + +#### To migrate a notebook instance to AL2023 + + 1. Stop your notebook instance. + + 2. Call [UpdateNotebookInstance](https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateNotebookInstance.html) with `PlatformIdentifier` set to `notebook-al2023-v1`. Or, in the SageMaker AI console, edit the notebook instance and change the **Platform identifier** to `notebook-al2023-v1`. + + 3. Start your notebook instance. + + 4. Verify your lifecycle configuration scripts and custom environments work correctly. + + + + +#### Important differences between Amazon Linux 2 and AL2023 + + * Package manager: `yum` (Amazon Linux 2) → `dnf` (AL2023) + + * PyTorch version: 2.6.0 (Amazon Linux 2) → 2.10.0 (AL2023) + + * Unsupported instance types: `ml.p2` (Amazon Linux 2) → `ml.p2`, `ml.p3`, `ml.p3dn`, `ml.inf1`, `ml.g3` (AL2023) + + + + +#### Lifecycle configuration script updates + +If your notebook instance uses a lifecycle configuration script, update any `yum` commands to use `dnf`. For example: + + + # AL2 (old) + sudo yum install -y htop + + # AL2023 (new) + sudo dnf install -y htop + +For a detailed comparison of Amazon Linux 2 and AL2023, see [Comparing AL2 and AL2023](https://docs.aws.amazon.com/linux/al2023/ug/compare-with-al2.html) in the _Amazon Linux 2023 User Guide_. + @@ -82 +149 @@ Date | Description -### Migrating to Amazon Linux 2 +### Migrating from AL1 @@ -84 +151 @@ Date | Description -Your existing AL1 notebook instance is not automatically migrated to Amazon Linux 2. To upgrade your AL1 notebook instance to Amazon Linux 2, you must create a new notebook instance, replicate your code and environment, and delete your old notebook instance. For more information, see the [Amazon Linux 2 migration blog](https://aws.amazon.com/blogs/machine-learning/migrate-your-work-to-amazon-sagemaker-notebook-instance-with-amazon-linux-2/ ). +Your existing AL1 notebook instance is not automatically migrated to AL2023. To upgrade, you must create a new notebook instance with `notebook-al2023-v1`, replicate your code and environment, and delete your old notebook instance.