Copy Fail is documented in VSA-2026-013, we don't have one for Dirty Frag yet as we're still investigating XCP-ng side regarding it.
For XOA, unattended updates should have installed the patched debian kernel, you just need to reboot it.
Debian security tracker states they are both fixed:
https://security-tracker.debian.org/tracker/CVE-2026-31431
https://security-tracker.debian.org/tracker/CVE-2026-43284