You can see the latest product updates for all of Google Cloud on the
[Google Cloud](https://docs.cloud.google.com/release-notes.md.txt) page, browse and filter all release notes in the
[Google Cloud console](https://console.cloud.google.com/release-notes),
or programmatically access release notes in
[BigQuery](https://console.cloud.google.com/bigquery?p=bigquery-public-data&d=google_cloud_release_notes&t=release_notes&page=table).

To get the latest product updates delivered to you, add the URL of this page to your
[feed
reader](https://wikipedia.org/wiki/Comparison_of_feed_aggregators), or add the
[feed URL](https://docs.cloud.google.com/feeds/cos-129-release-notes.xml) directly.

## November 11, 2026

Change

### cos-129-19506-625-25

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.114](https://cos.googlesource.com/third_party/kernel/+/1bac64d736f17f5ed23cbcb8ec3f6edf39ccab9a) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19506.625.25/lakitu/gpu_driver_versions.textproto) |

Feature Added suppport for lustre-client-driver 2.16 in
new lustre package lustre-client-drivers-2_16.
Security Fixed CVE-2025-45582 in app-arch/tar.
Security Fixed CVE-2025-52565 in nvidia-container-toolkit.
Security Fixed CVE-2026-103111 in dev-libs/libpcre.
Security Fixed CVE-2026-118669 in dev-python/oauthlib.
Security Fixed CVE-2026-30922 in dev-python/pyasn1.
Security Fixed CVE-2026-41567 in cri-tools.
Security Fixed CVE-2026-63209 in docker.

## November 06, 2026

Change

### cos-129-19506-625-14

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.114](https://cos.googlesource.com/third_party/kernel/+/1bac64d736f17f5ed23cbcb8ec3f6edf39ccab9a) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19506.625.14/lakitu/gpu_driver_versions.textproto) |

Announcement This is an [LTS Refresh release.](https://docs.cloud.google.com/container-optimized-os/docs/concepts/versioning.md.txt#lts_refresh_releases)
Change Upgraded sys-apps/casfs to v0.1.24.
Feature Added RTC support in A4X-Max images.
Feature Enabled PCI peer to peer direct memory access for 64k kernels.
Fixed Fixed a 60 second outage after an idpf function reset on IPU E2100 caused by misreading PFGEN_RSTAT.
Fixed Updated cos-gpu-installer to v2.7.12. It installs ucodes firmwares for r615 and newer GPU driver versions.
Security Fixed CVE-2024-41110 in cri-tools.
Security Fixed CVE-2026-116587 in guest-agent.
Security Fixed CVE-2026-29181, CVE-2025-31133, CVE-2024-25621 in docker.
Security Fixed CVE-2026-32285, CVE-2026-84304 in cni-plugins.
Security Fixed CVE-2026-34986 in guest-agent.
Security Fixed CVE-2026-35469 in cri-tools.
Security Fixed CVE-2026-39883 in cos-extensions.
Security Fixed CVE-2026-39883 in docker.
Security Fixed CVE-2026-45022, CVE-2026-24051, CVE-2026-53488 in google-osconfig-agent.
Security Fixed CVE-2026-63209 in containerd.
Security Fixed CVE-2026-63209 in node-problem-detector.
Security Fixed CVE-2026-63209, CVE-2025-65637 in google-osconfig-agent.
Security Fixed CVE-2026-84304 in containerd.
Security Fixed CVE-2026-84304 in docker.
Security Fixed CVE-2026-84304 in kubernetes.
Security Fixed CVE-2026-84304, CVE-2026-29181 in node-problem-detector.
Security Fixed CVE-2026-84304, CVE-2026-32285 in cri-tools.
Security Fixed CVE-2026-84445 in google-guest-agent.
Security Fixed CVE-2026-84445 in google-osconfig-agent.
Security Fixed CVE-2026-84445 in guest-agent.
Security Updated curl to v8.22.0. This resolves CVE-2026-18924, CVE-2026-13608, CVE-2026-80229, CVE-2026-80255 and CVE-2026-19931.
Security Updated libpcre2 to v10.49. This resolves CVE-2026-86145 and CVE-2026-103111.
Security Updated pyjwt to v2.14.0. This resolves CVE-2026-102266, CVE-2026-102267, CVE-2026-102268 and CVE-2026-102271.

## October 30, 2026

Change

### cos-129-19506-578-33

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.113](https://cos.googlesource.com/third_party/kernel/+/d85203a42d8b86ef624aecfdbd44361fa8a62c51) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19506.578.33/lakitu/gpu_driver_versions.textproto) |

Fixed Fixed an IDPF bug that could cause indefinite IPv4 route loss after a hard NIC reset.
Feature Enabled EROFS support.
Fixed Added support for NVIDIA driver v580.196.07.
Fixed Added support for NVIDIA driver v595.112.07.
Fixed Upgraded app-arch/zstd to v1.5.7-r1.
Fixed Upgraded app-containers/docker-credential-helpers to v0.9.12.
Fixed Upgraded app-editors/vim to v9.2.1229, Upgraded app-editors/vim-core to v9.2.1229.
Fixed Upgraded app-misc/ca-certificates to v20260816.3.131.1.
Fixed Upgraded dev-db/sqlite to v3.54.1.
Fixed Upgraded dev-libs/expat to v2.9.0.
Fixed Upgraded dev-libs/nss to v3.132.
Fixed Upgraded net-fs/nfs-utils to v2.6.4.
Fixed Upgraded sys-libs/libxcrypt to v4.4.38-r1.
Security Fixed CVE-2026-33186 in cni-plugins.
Security Fixed CVE-2026-33186 in containerd.
Security Fixed CVE-2026-33186 in google-osconfig-agent.
Security Fixed CVE-2026-42508, CVE-2026-39834, CVE-2026-39832, CVE-2026-39831, CVE-2026-46595 in google-osconfig-agent.
Security Fixed KCTF-d095321 in the Linux kernel.
Security Updated app-arch/brotli to 1.0.10. This resolves CVE-2026-111497.

## October 27, 2026

Change

### cos-129-19506-578-21

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.113](https://cos.googlesource.com/third_party/kernel/+/120d67cd4f74b312486d3b1efa79fde8fa440eaa) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19506.578.21/lakitu/gpu_driver_versions.textproto) |

Change Updated app-admin/google-guest-configs to v20261025.00.
Security Fixed CVE-2026-77214 in dev-libs/expat.
Change Runtime sysctl changes:

- Changed: fs.epoll.max_user_watches: 1808562 -\> 1808517
- Changed: fs.fanotify.max_user_marks: 68416 -\> 68412
- Changed: fs.inotify.max_user_watches: 64192 -\> 64189
- Changed: kernel.threads-max: 63183 -\> 63178
- Changed: net.ipv4.tcp_mem: 94020 125361 188040 -\> 94017 125357 188034
- Changed: net.ipv4.udp_mem: 188040 250722 376080 -\> 188034 250715 376068
- Changed: user.max_cgroup_namespaces: 31591 -\> 31589
- Changed: user.max_fanotify_marks: 68416 -\> 68412
- Changed: user.max_inotify_watches: 64192 -\> 64189
- Changed: user.max_ipc_namespaces: 31591 -\> 31589
- Changed: user.max_mnt_namespaces: 31591 -\> 31589
- Changed: user.max_net_namespaces: 31591 -\> 31589
- Changed: user.max_pid_namespaces: 31591 -\> 31589
- Changed: user.max_time_namespaces: 31591 -\> 31589
- Changed: user.max_user_namespaces: 31591 -\> 31589
- Changed: user.max_uts_namespaces: 31591 -\> 31589

<br />

## October 22, 2026

Change

### cos-129-19506-578-9

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.113](https://cos.googlesource.com/third_party/kernel/+/38d8fc183d307b8c9fd3db3d33f44d32f55ae31e) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19506.578.9/lakitu/gpu_driver_versions.textproto) |

Announcement This is an [LTS Refresh release.](https://docs.cloud.google.com/container-optimized-os/docs/concepts/versioning.md.txt#lts_refresh_releases)
Fixed Updated cos-gpu-installer to v2.7.11 and toolbox to v20261020.
Fixed Upgraded app-misc/ca-certificates to v20260816.3.125. This removes the certificates affected by the eMudhra intermediate certificate compromise.
Fixed Upgraded dev-libs/nss to v3.131.1. This removes the certificates affected by the eMudhra intermediate certificate compromise.
Security Fixed CVE-2026-111943 in dev-lang/go.
Security Fixed CVE-2026-33186 in cri-tools.
Security Fixed CVE-2026-39831 in node-problem-detector.
Security Fixed CVE-2026-39833 in nvidia-container-toolkit.
Security Fixed CVE-2026-46595, CVE-2026-39832 in cri-tools.
Security Fixed CVE-2026-98432 in the Linux kernel.
Change Runtime sysctl changes:

- Changed: fs.epoll.max_user_watches: 1808517 -\> 1808562
- Changed: fs.fanotify.max_user_marks: 68412 -\> 68416
- Changed: fs.inotify.max_user_watches: 64189 -\> 64192
- Changed: kernel.threads-max: 63178 -\> 63183
- Changed: net.ipv4.tcp_mem: 94017 125357 188034 -\> 94020 125361 188040
- Changed: net.ipv4.udp_mem: 188034 250715 376068 -\> 188040 250722 376080
- Changed: user.max_cgroup_namespaces: 31589 -\> 31591
- Changed: user.max_fanotify_marks: 68412 -\> 68416
- Changed: user.max_inotify_watches: 64189 -\> 64192
- Changed: user.max_ipc_namespaces: 31589 -\> 31591
- Changed: user.max_mnt_namespaces: 31589 -\> 31591
- Changed: user.max_net_namespaces: 31589 -\> 31591
- Changed: user.max_pid_namespaces: 31589 -\> 31591
- Changed: user.max_time_namespaces: 31589 -\> 31591
- Changed: user.max_user_namespaces: 31589 -\> 31591
- Changed: user.max_uts_namespaces: 31589 -\> 31591

<br />

## October 19, 2026

Change

### cos-129-19506-549-22

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.112](https://cos.googlesource.com/third_party/kernel/+/f4481ae514bfb44391addf1ce0dc85a372e5023f) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19506.549.22/lakitu/gpu_driver_versions.textproto) |

Fixed Added support for loading the pci-pf-stub module.
Fixed Fix docker cp failure when copying to/from containers with nested bind mounts.
Fixed Upgraded app-editors/vim to v9.2.1152, Upgraded app-editors/vim-core to v9.2.1152.
Security Fix CVE-2026-19445 by upgrading to python 3.11.17.
Security Fix CVE-2026-82474 on app-admin/sudo
Security Fixed CVE-2026-5435 in sys-libs/glibc.
Security Fixed CVE-2026-99999 in the Linux kernel.
Security Upgraded dev-lang/python to v3.11.16. This fixes CVE-2026-6100.

## October 12, 2026

Change

### cos-129-19506-549-7

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.112](https://cos.googlesource.com/third_party/kernel/+/e0eda3654b9ec529967ef7a996ea61b8f133bb95) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19506.549.7/lakitu/gpu_driver_versions.textproto) |

Announcement This is an [LTS Refresh release.](https://docs.cloud.google.com/container-optimized-os/docs/concepts/versioning.md.txt#lts_refresh_releases)
Fixed Added support for lustre v2.14.0_p262-r1
Security Fixed CVE-2026-18220 in sys-libs/binutils-libs.
Security Fixed CVE-2026-5450 in sys-libs/glibc.
Security Patch CVE-2026-49264, CVE-2026-49265 on dev-python/oauthlib.

## October 06, 2026

Change

### cos-129-19506-505-25

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.110](https://cos.googlesource.com/third_party/kernel/+/e8aea8a5b77baffbe8202925d0d4857248041049) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19506.505.25/lakitu/gpu_driver_versions.textproto) |

Change Updated dev-libs/openssl to v3.5.9.
Fixed Added support for NVIDIA driver v595.91.07.
Fixed Added support for net-fs/lustre-client-drivers v2.14.0_p262.
Fixed Added the "watchdog_timeout" module parameter to the idpf driver.
Fixed Rebuilt Go binaries with Go 1.25.14.
Fixed Upgraded app-admin/google-guest-configs to v20260928.00.
Fixed Upgraded dev-libs/expat to v2.8.5.
Fixed Upgraded sys-apps/xemu to v0.0.11.
Fixed Upgraded sys-libs/timezone-data to v2026e.
Fixed Upgraded sys-process/lsof to v4.99.7.
Security Fixed CVE-2026-5928 in sys-libs/glibc.
Security Upgraded dev-libs/libxml2 to v2.15.4. This fixes CVE-2026-86140.

## September 28, 2026

Change

### cos-129-19506-505-8

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.110](https://cos.googlesource.com/third_party/kernel/+/39c6d6f687e655460d68a8405647b6b44e6e688b) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19506.505.8/lakitu/gpu_driver_versions.textproto) |

Announcement This is an [LTS Refresh release.](https://docs.cloud.google.com/container-optimized-os/docs/concepts/versioning.md.txt#lts_refresh_releases)
Change Ensure time sync prior to TLS handshake.
Fixed Added support for bare metal TPUs.

## September 21, 2026

Change

### cos-129-19506-448-53

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.105](https://cos.googlesource.com/third_party/kernel/+/59eca8c9ae14588103453a37c861e6ab42230de4) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19506.448.53/lakitu/gpu_driver_versions.textproto) |

Feature Added support for loading the CephFS kernel driver.
Feature Fixed a performance issue in the GVE driver on multi-NUMA systems.
Fixed Fixed an issue where temporary efivarfs mounts under /tmp could persist after boot.
Security Fixed CVE-2026-0864 in dev-lang/python.
Security Fixed CVE-2026-15308 in dev-lang/python.
Security Upgraded net-misc/rsync to version 3.5.0. This fixes CVE-2026-53791, CVE-2026-53784, CVE-2026-53786, CVE-2026-53789, CVE-2026-53795, CVE-2026-53797, CVE-2026-53798, CVE-2026-53799, CVE-2026-53800, CVE-2026-53801, CVE-2026-53802, CVE-2026-53803, CVE-2026-70455, CVE-2026-70457, CVE-2026-70459, CVE-2026-70461, and CVE-2026-70463.

## September 17, 2026

Change

### cos-129-19506-448-36

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.105](https://cos.googlesource.com/third_party/kernel/+/043c0c8ea2535cc8f7eda40e60161f375a3878ad) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19506.448.36/lakitu/gpu_driver_versions.textproto) |

Security Fixed CVE-2026-56391 in sys-apps/coreutils.
Security Fixed CVE-2026-80590 in the Linux kernel.
Security Fixed CVE-2026-80737 in the Linux kernel.
Security Fixed CVE-2026-80788 in the Linux kernel.
Security Fixed CVE-2026-80789 in the Linux kernel.
Security Fixed CVE-2026-80791 in the Linux kernel.
Security Fixed CVE-2026-80792 in the Linux kernel.
Security Fixed CVE-2026-80793 in the Linux kernel.
Security Fixed CVE-2026-80805 in the Linux kernel.
Security Fixed CVE-2026-80806 in the Linux kernel.
Security Fixed CVE-2026-80808 in the Linux kernel.
Security Fixed CVE-2026-80837 in the Linux kernel.
Security Fixed CVE-2026-80838 in the Linux kernel.
Security Fixed CVE-2026-80839 in the Linux kernel.
Security Fixed CVE-2026-80842 in the Linux kernel.
Security Fixed CVE-2026-80843 in the Linux kernel.
Security Fixed CVE-2026-80845 in the Linux kernel.
Security Fixed CVE-2026-80852 in the Linux kernel.
Security Fixed CVE-2026-80854 in the Linux kernel.
Security Fixed CVE-2026-80855 in the Linux kernel.
Security Fixed CVE-2026-80856 in the Linux kernel.
Security Fixed CVE-2026-80862 in the Linux kernel.
Security Fixed CVE-2026-80916 in the Linux kernel.
Security Fixed CVE-2026-80917 in the Linux kernel.

## September 08, 2026

Change

### cos-129-19506-448-20

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.105](https://cos.googlesource.com/third_party/kernel/+/583df4fb246cc3cdc69bbb933a78ef88032ecfd6) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19506.448.20/lakitu/gpu_driver_versions.textproto) |

Fixed Fixed CVE-2026-33186 in app-containers/docker.
Fixed Fixed docker cp failure when copying to/from containers with symlinked bind mounts.
Fixed Fixed CVE-2026-33186 in app-admin/extensions-manager.
Fixed Fixed CVE-2026-33186 in app-admin/google-osconfig-agent.
Fixed Fixed CVE-2026-33186 in app-admin/node-problem-detector.
Fixed Fixed CVE-2026-33186 in app-containers/containerd.
Fixed Fixed CVE-2026-33186 in app-emulation/kubernetes.
Fixed Upgraded app-containers/docker-credential-helpers to v0.9.9.
Fixed Upgraded dev-db/sqlite to v3.53.4.
Fixed Upgraded dev-libs/expat to v2.8.4.
Fixed Upgraded dev-libs/xxhash to v0.8.3-r2.
Fixed Upgraded net-libs/libnftnl to v1.2.9.
Fixed Fixed CVE-2026-6238 in sys-libs/glibc.
Security Updated dev-go/net to v0.55.0 to fix CVE-2026-25680.
Change Runtime sysctl changes:

- Changed: net.ipv4.udp_mem: 188034 250714 376068 -\> 188034 250715 376068

<br />

## August 31, 2026

Change

### cos-129-19506-448-8

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.105](https://cos.googlesource.com/third_party/kernel/+/583df4fb246cc3cdc69bbb933a78ef88032ecfd6) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19506.448.8/lakitu/gpu_driver_versions.textproto) |

Change Updated containerd and containerd-test to v2.2.7.
Fixed LTS Refresh from main-R129-cos-6.12 to release-R129-cos-6.12
Fixed Upgraded app-admin/fluent-bit to v4.2.8.
Fixed Upgraded app-arch/unzip to v6.0_p31.
Fixed Upgraded app-shells/dash to v0.5.13.5.
Fixed Upgraded dev-libs/libverto to v0.3.2-r1.
Fixed Upgraded dev-libs/popt to v1.19-r1.
Fixed Upgraded sys-apps/acl to v2.4.0-r2.
Fixed Upgraded sys-auth/passwdqc to v2.0.3-r1.
Security Fixed CVE-2026-68293 in the Linux kernel.
Security Upgraded dev-libs/libxml2 to v2.15.3. This fixes CVE-2026-0989, CVE-2026-0990, and CVE-2026-0992.
Change Runtime sysctl changes:

- Changed: net.ipv4.udp_mem: 188034 250715 376068 -\> 188034 250714 376068

<br />

## August 24, 2026

Change

### cos-129-19506-299-161

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.94](https://cos.googlesource.com/third_party/kernel/+/b6c0270f579107bbe932382609e40146cb7e8ea6) | v27.5.1 | v2.2.6 | [See List](https://storage.googleapis.com/cos-tools/19506.299.161/lakitu/gpu_driver_versions.textproto) |

Change Updated cos-gpu-installer to v2.7.7.
Fixed Added support for net-fs/lustre-client-drivers v2.14.0_p259.
Fixed Upgraded sys-apps/xemu to v0.0.10.
Security Fixed CVE-2026-68096 in the Linux kernel.
Security Fixed CVE-2026-68096 in the Linux kernel.
Security Fixed CVE-2026-68096 in the Linux kernel.
Security Fixed CVE-2026-68129 in the linux kernel
Security Fixed CVE-2026-68146 in the Linux kernel.
Security Fixed CVE-2026-68325 in the Linux kernel.
Security Fixed CVE-2026-68338 in the Linux kernel.
Security Fixed CVE-2026-68422 in the Linux kernel.
Security Fixed KCTF-0650f1c in the Linux Kernel.

## August 19, 2026

Change

### cos-129-19506-299-148

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.94](https://cos.googlesource.com/third_party/kernel/+/aff334becfdb3e9c96a3fe8628c553b0934b5b08) | v27.5.1 | v2.2.6 | [See List](https://storage.googleapis.com/cos-tools/19506.299.148/lakitu/gpu_driver_versions.textproto) |

Fixed Updated cos-gpu-installer to v2.7.6.
Security Fixed CVE-2026-68284 in the Linux kernel.
Security Fixed CVE-2026-68398 in the Linux kernel.
Change Runtime sysctl changes:

- Changed: net.ipv4.udp_mem: 188034 250714 376068 -\> 188034 250715 376068

<br />

## August 17, 2026

Change

### cos-129-19506-299-137

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.94](https://cos.googlesource.com/third_party/kernel/+/f8942cf365df41f4179e94e9c9af498b8509984f) | v27.5.1 | v2.2.6 | [See List](https://storage.googleapis.com/cos-tools/19506.299.137/lakitu/gpu_driver_versions.textproto) |

Feature Enabled CONFIG_UDMABUF on x86_64.
Security Fixed CVE-2026-64561 in the Linux kernel.
Security Fixed CVE-2026-64562 in the Linux kernel.
Security Fixed CVE-2026-64567 in the Linux kernel.
Security Fixed CVE-2026-64572 in the Linux kernel.
Security Fixed CVE-2026-64576 in the Linux kernel.
Security Fixed CVE-2026-64579 in the Linux kernel.
Security Fixed CVE-2026-64590 in the Linux kernel.
Security Fixed CVE-2026-64593 in the Linux kernel.
Security Fixed CVE-2026-64597 in the Linux kernel.
Security Fixed CVE-2026-64598 in the Linux kernel.
Security Fixed CVE-2026-64604 in the Linux kernel.
Security Fixed CVE-2026-68092 in the Linux kernel.
Security Fixed CVE-2026-68093 in the Linux kernel.
Security Fixed CVE-2026-68116 in the Linux kernel.
Security Fixed CVE-2026-68119 in the Linux kernel.
Security Fixed CVE-2026-68136 in the Linux kernel.
Security Fixed CVE-2026-68139 in the Linux kernel.
Security Fixed CVE-2026-68142 in the Linux kernel.
Security Fixed CVE-2026-68145 in the Linux kernel.
Security Fixed CVE-2026-68147 in the Linux kernel.
Security Fixed CVE-2026-68149 in the Linux kernel.
Security Fixed CVE-2026-68171 in the Linux kernel.
Security Fixed CVE-2026-68184 in the Linux kernel.
Security Fixed CVE-2026-68186 in the Linux kernel.
Security Fixed CVE-2026-68187 in the Linux kernel.
Security Fixed CVE-2026-68296 in the Linux kernel.
Security Fixed CVE-2026-68299 in the Linux kernel.
Security Fixed CVE-2026-68329 in the Linux kernel.
Security Fixed CVE-2026-68336 in the Linux kernel.
Security Fixed CVE-2026-68343 in the Linux kernel.
Security Fixed CVE-2026-68386 in the Linux kernel.
Security Fixed CVE-2026-68388 in the Linux kernel.
Security Fixed CVE-2026-68396 in the Linux kernel.
Security Fixed CVE-2026-68425 in the Linux kernel.
Security Fixed CVE-2026-68428 in the Linux kernel.
Security Fixed CVE-2026-68432 in the Linux kernel.
Security Fixed CVE-2026-68442 in the Linux kernel.
Security Fixed CVE-2026-68450 in the Linux kernel.
Change Runtime sysctl changes:

- Changed: net.ipv4.udp_mem: 188034 250715 376068 -\> 188034 250714 376068

<br />

## August 11, 2026

Change

### cos-129-19506-299-116

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.94](https://cos.googlesource.com/third_party/kernel/+/e55e3beb430afda0e871fbacbc825fd78ca377e6) | v27.5.1 | v2.2.6 | [See List](https://storage.googleapis.com/cos-tools/19506.299.116/lakitu/gpu_driver_versions.textproto) |

Fixed Added kernel patch to reduce bcache garbage collection sleep
interval to prevent I/O stalls.
Fixed Fixed CVE-2026-33186 in google-guest-agent.
Security Fixed CVE-2026-64227 in the Linux kernel.
Security Fixed CVE-2026-64279 in the Linux kernel.
Security Fixed CVE-2026-64286 in the Linux kernel.
Security Fixed CVE-2026-64287 in the Linux kernel.
Security Fixed CVE-2026-64352 in the Linux kernel.
Security Fixed CVE-2026-64375 in the Linux kernel.
Security Fixed CVE-2026-64401 in the Linux kernel.
Security Fixed CVE-2026-64413 in the Linux kernel.
Security Fixed CVE-2026-64416 in the Linux kernel.
Security Fixed CVE-2026-64476 in the Linux kernel.
Security Fixed CVE-2026-64508 in the Linux kernel.
Security Fixed CVE-2026-64530 in the Linux kernel.
Security Fixed CVE-2026-64532 in the Linux kernel.
Security Fixed CVE-2026-64533 in the Linux kernel.
Security Fixed CVE-2026-64534 in the Linux kernel.
Security Fixed CVE-2026-64535 in the Linux kernel.
Security Fixed CVE-2026-64538 in the Linux kernel.
Security Fixed CVE-2026-64542 in the Linux kernel.
Security Fixed CVE-2026-64545 in the Linux kernel.
Security Fixed CVE-2026-64546 in the Linux kernel.
Security Fixed CVE-2026-64548 in the Linux kernel.
Security Fixed CVE-2026-64552 in the Linux kernel.
Security Fixed CVE-2026-64554 in the Linux kernel.
Security Fixed CVE-2026-64555 in the Linux kernel.
Security Fixed KCTF-8173f7e in the Linux Kernel.
Change Runtime sysctl changes:

- Changed: net.ipv4.udp_mem: 188034 250714 376068 -\> 188034 250715 376068

<br />

## August 04, 2026

Change

### cos-129-19506-299-82

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.94](https://cos.googlesource.com/third_party/kernel/+/2e631b5a74208db4d7798eed9351c3ca07662e37) | v27.5.1 | v2.2.6 | [See List](https://storage.googleapis.com/cos-tools/19506.299.82/lakitu/gpu_driver_versions.textproto) |

Change Updated containerd to v2.2.6.
Change cchost: Add bpf-lsm-policy for VM restrictions.
Security Fixed CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, and CVE-2026-46598 in dev-go/crypto.
Security Fixed CVE-2026-58470 in net-misc/wget.
Security Fixed CVE-2026-59890 in dev-python/setuptools.
Security Fixed CVE-2026-64244 in the Linux kernel.
Security Fixed CVE-2026-64247 in the Linux kernel.
Security Fixed CVE-2026-64253 in the Linux kernel.
Security Fixed CVE-2026-64265 in the Linux kernel.
Security Fixed CVE-2026-64266 in the Linux kernel.
Security Fixed CVE-2026-64284 in the Linux kernel.
Security Fixed CVE-2026-64289 in the Linux kernel.
Security Fixed CVE-2026-64294 in the Linux kernel.
Security Fixed CVE-2026-64298 in the Linux kernel.
Security Fixed CVE-2026-64299 in the Linux kernel.
Security Fixed CVE-2026-64306 in the Linux kernel.
Security Fixed CVE-2026-64313 in the Linux kernel.
Security Fixed CVE-2026-64317 in the Linux kernel.
Security Fixed CVE-2026-64319 in the Linux kernel.
Security Fixed CVE-2026-64320 in the Linux kernel.
Security Fixed CVE-2026-64322 in the Linux kernel.
Security Fixed CVE-2026-64323 in the Linux kernel.
Security Fixed CVE-2026-64324 in the Linux kernel.
Security Fixed CVE-2026-64326 in the Linux kernel.
Security Fixed CVE-2026-64354 in the Linux kernel.
Security Fixed CVE-2026-64355 in the Linux kernel.
Security Fixed CVE-2026-64357 in the Linux kernel.
Security Fixed CVE-2026-64368 in the Linux kernel.
Security Fixed CVE-2026-64370 in the Linux kernel.
Security Fixed CVE-2026-64373 in the Linux kernel.
Security Fixed CVE-2026-64378 in the Linux kernel.
Security Fixed CVE-2026-64379 in the Linux kernel.
Security Fixed CVE-2026-64380 in the Linux kernel.
Security Fixed CVE-2026-64381 in the Linux kernel.
Security Fixed CVE-2026-64382 in the Linux kernel.
Security Fixed CVE-2026-64383 in the Linux kernel.
Security Fixed CVE-2026-64384 in the Linux kernel.
Security Fixed CVE-2026-64385 in the Linux kernel.
Security Fixed CVE-2026-64386 in the Linux kernel.
Security Fixed CVE-2026-64387 in the Linux kernel.
Security Fixed CVE-2026-64411 in the Linux kernel.
Security Fixed CVE-2026-64412 in the Linux kernel.
Security Fixed CVE-2026-64414 in the Linux kernel.
Security Fixed CVE-2026-64415 in the Linux kernel.
Security Fixed CVE-2026-64418 in the Linux kernel.
Security Fixed CVE-2026-64422 in the Linux kernel.
Security Fixed CVE-2026-64423 in the Linux kernel.
Security Fixed CVE-2026-64425 in the Linux kernel.
Security Fixed CVE-2026-64432 in the Linux kernel.
Security Fixed CVE-2026-64435 in the Linux kernel.
Security Fixed CVE-2026-64436 in the Linux kernel.
Security Fixed CVE-2026-64448 in the Linux kernel.
Security Fixed CVE-2026-64456 in the Linux kernel.
Security Fixed CVE-2026-64473 in the Linux kernel.
Security Fixed CVE-2026-64474 in the Linux kernel.
Security Fixed CVE-2026-64475 in the Linux kernel.
Security Fixed CVE-2026-64512 in the Linux kernel.
Security Fixed CVE-2026-64514 in the Linux kernel.
Security Fixed CVE-2026-64556 in the Linux kernel.
Security Upgraded net-libs/nghttp2 to 1.69.0 and fixed CVE-2026-58055.
Change Runtime sysctl changes:

- Changed: net.ipv4.udp_mem: 188034 250715 376068 -\> 188034 250714 376068

<br />

## July 28, 2026

Change

### cos-129-19506-299-60

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.94](https://cos.googlesource.com/third_party/kernel/+/1028c7249687e9528c5a2ec2ac154416ad9d8c50) | v27.5.1 | v2.2.5 | [See List](https://storage.googleapis.com/cos-tools/19506.299.60/lakitu/gpu_driver_versions.textproto) |

Fixed Updated udev rule for protected_stateful_partition
Fixed Upgraded app-admin/fluent-bit to v4.2.7.
Security Fixed CVE-2026-29111 in sys-apps/systemd
Security Fixed CVE-2026-3644 in dev-lang/python
Security Fixed CVE-2026-40355 and CVE-2026-40356 in
app-crypt/mit-krb5.
Security Fixed CVE-2026-53381 in the Linux kernel.
Security Fixed CVE-2026-53385 in the Linux kernel.
Security Fixed CVE-2026-53388 in the Linux kernel.
Security Fixed CVE-2026-53391 in the Linux kernel.
Security Fixed CVE-2026-53392 in the Linux kernel.
Security Fixed CVE-2026-53393 in the Linux kernel.
Security Fixed CVE-2026-53394 in the Linux kernel.
Security Fixed CVE-2026-53397 in the Linux kernel.
Security Fixed CVE-2026-53398 in the Linux kernel.
Security Fixed CVE-2026-53400 in the Linux kernel.
Security Fixed CVE-2026-59995, CVE-2026-59996, CVE-2026-59997, CVE-2026-59999, CVE-2026-60000, CVE-2026-60001, and
CVE-2026-60002 in openssh.
Security Fixed CVE-2026-6019 in dev-lang/python
Security Fixed CVE-2026-63795 in the Linux kernel.
Security Fixed CVE-2026-63800 in the Linux kernel.
Security Fixed CVE-2026-63802 in the Linux kernel.
Security Fixed CVE-2026-63806 in the Linux kernel.
Security Fixed CVE-2026-63807 in the Linux kernel.
Security Fixed CVE-2026-63809 in the Linux kernel.
Security Fixed CVE-2026-63810 in the Linux kernel.
Security Fixed CVE-2026-63823 in the Linux kernel.
Security Fixed CVE-2026-63824 in the Linux kernel.
Security Fixed CVE-2026-63827 in the Linux kernel.
Security Fixed CVE-2026-63828 in the Linux kernel.
Security Fixed CVE-2026-63829 in the Linux kernel.
Security Fixed CVE-2026-63830 in the Linux kernel.
Security Fixed CVE-2026-63833 in the Linux kernel.
Security Fixed CVE-2026-64187 in the Linux kernel.
Security Fixed CVE-2026-64189 in the Linux kernel.

## July 20, 2026

Change

### cos-129-19506-299-36

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.94](https://cos.googlesource.com/third_party/kernel/+/2d3868d9c2a54dbfe692ca8ea26defa8889e6433) | v27.5.1 | v2.2.5 | [See List](https://storage.googleapis.com/cos-tools/19506.299.36/lakitu/gpu_driver_versions.textproto) |

Fixed Fixed a bug in the XFS file system where direct I/O writes could use
outdated block mappings during Copy-on-Write operations.
Fixed Upgraded net-misc/curl to 8.21.0.
Security Fixed CVE-2026-58013,CVE-2026-58014,CVE-2026-58015,CVE-2026-58016 in glib.
Security Fixed CVE-2026-43216 in the Linux kernel.
Security Fixed CVE-2026-58469, CVE-2026-58471, CVE-2026-58472 in net-misc/wget.
Security Updated containerd to v2.2.5. This resolves
CVE-2026-46680,CVE-2026-50195,CVE-2026-53492,CVE-2026-53488.

## July 13, 2026

Change

### cos-129-19506-299-20

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.94](https://cos.googlesource.com/third_party/kernel/+/bc1d3c4eb1b1c9af6d66b58a41aa4f5c4ffe0a57) | v27.5.1 | v2.2.3 | [See List](https://storage.googleapis.com/cos-tools/19506.299.20/lakitu/gpu_driver_versions.textproto) |

Feature Enabled CONFIG_MEMORY_FAILURE in the Linux kernel for ARM64. This should improve memory errors handling when running CUDA workloads.
Fixed Changed google-guest-agent's plugin installation path to /var/lib/google/guest-agent.
Fixed Upgraded app-admin/fluent-bit to v4.2.6.
Fixed Upgraded app-containers/docker-credential-helpers to v0.9.8.
Security Fixed CVE-2026-40225 in sys-apps/systemd.
Security Fixed CVE-2026-43010 in the Linux kernel.
Security Fixed CVE-2026-53167 in the Linux kernel.
Security Fixed CVE-2026-53341 in the Linux kernel.
Security Fixed KCTF-736b380 in the Linux kernel.

## July 09, 2026

Change

### cos-129-19506-299-8

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.94](https://cos.googlesource.com/third_party/kernel/+/528543b74575bd46e7fc7ccc61eabc1868789e84) | v27.5.1 | v2.2.3 | [See List](https://storage.googleapis.com/cos-tools/19506.299.8/lakitu/gpu_driver_versions.textproto) |

Fixed Added support for NVIDIA GRID driver version 580.159.03.
Security Fixed CVE-2026-53359 in the Linux kernel.

## July 06, 2026

Change

### cos-129-19506-299-3

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.94](https://cos.googlesource.com/third_party/kernel/+/a9a6e2d52bec1f807503b02b401205a67f642d04) | v27.5.1 | v2.2.3 | [See List](https://storage.googleapis.com/cos-tools/19506.299.3/lakitu/gpu_driver_versions.textproto) |

Change Updated the Linux kernel to v6.12.94. It resolves CVE-2026-52908,CVE-2026-52910, CVE-2026-52912,CVE-2026-52920, CVE-2026-52921,CVE-2026-52923, CVE-2026-52925,CVE-2026-52927,CVE-2026-52928,CVE-2026-52930, CVE-2026-52933,CVE-2026-52936, CVE-2026-52942,CVE-2026-52943, CVE-2026-52946,CVE-2026-52967, CVE-2026-52969,CVE-2026-52970, CVE-2026-52972,CVE-2026-52974, CVE-2026-52977,CVE-2026-52980, CVE-2026-52981,CVE-2026-52984, CVE-2026-52986,CVE-2026-52989, CVE-2026-52990,CVE-2026-52998, CVE-2026-52999,CVE-2026-53001, CVE-2026-53002,CVE-2026-53003, CVE-2026-53006,CVE-2026-53012, CVE-2026-53013,CVE-2026-53014, CVE-2026-53021,CVE-2026-53023, CVE-2026-53031,CVE-2026-53032, CVE-2026-53033,CVE-2026-53034, CVE-2026-53035,CVE-2026-53036, CVE-2026-53038,CVE-2026-53050, CVE-2026-53053,CVE-2026-53060, CVE-2026-53061,CVE-2026-53062, CVE-2026-53063,CVE-2026-53064, CVE-2026-53069,CVE-2026-53074, CVE-2026-53075,CVE-2026-53076, CVE-2026-53080,CVE-2026-53081, CVE-2026-53083,CVE-2026-53084, CVE-2026-53085,CVE-2026-53094, CVE-2026-53096,CVE-2026-53111, CVE-2026-53115,CVE-2026-53120, CVE-2026-53122,CVE-2026-53123, CVE-2026-53126,CVE-2026-53129, CVE-2026-53132.
Fixed Upgraded app-admin/oslogin to v20260626.00.
Fixed Upgraded dev-db/sqlite to v3.53.3.
Fixed Upgraded dev-libs/expat to v2.8.2.
Fixed Upgraded net-misc/socat to v1.8.1.3.
Fixed Upgraded sys-apps/acl to v2.4.0.
Security Fixed CVE-2026-35388 in net-misc/openssh.
Security Fixed CVE-2026-40226 in sys-apps/systemd.
Security Fixed CVE-2026-53122 in the Linux kernel.
Security Fixed CVE-2026-53131 in the Linux kernel.
Security Fixed CVE-2026-53134 in the Linux kernel.
Security Fixed CVE-2026-53154 in the Linux kernel.
Security Fixed CVE-2026-53156 in the Linux kernel.
Security Fixed CVE-2026-53168 in the Linux kernel.
Security Fixed CVE-2026-53180 in the Linux kernel.
Security Fixed CVE-2026-53181 in the Linux kernel.
Security Fixed CVE-2026-53184 in the Linux kernel.
Security Fixed CVE-2026-53185 in the Linux kernel.
Security Fixed CVE-2026-53189 in the Linux kernel.
Security Fixed CVE-2026-53191 in the Linux kernel.
Security Fixed CVE-2026-53199 in the Linux kernel.
Security Fixed CVE-2026-53212 in the Linux kernel.
Security Fixed CVE-2026-53214 in the Linux kernel.
Security Fixed CVE-2026-53218 in the Linux kernel.
Security Fixed CVE-2026-53219 in the Linux kernel.
Security Fixed CVE-2026-53220 in the Linux kernel.
Security Fixed CVE-2026-53223 in the Linux kernel.
Security Fixed CVE-2026-53229 in the Linux kernel.
Security Fixed CVE-2026-53230 in the Linux kernel.
Security Fixed CVE-2026-53232 in the Linux kernel.
Security Fixed CVE-2026-53235 in the Linux kernel.
Security Fixed CVE-2026-53236 in the Linux kernel.
Security Fixed CVE-2026-53239 in the Linux kernel.
Security Fixed CVE-2026-53249 in the Linux kernel.
Security Fixed CVE-2026-53261 in the Linux kernel.
Security Fixed CVE-2026-53264 in the Linux kernel.
Security Fixed CVE-2026-53265 in the Linux kernel.
Security Fixed CVE-2026-53266 in the Linux kernel.
Security Fixed CVE-2026-53267 in the Linux kernel.
Security Fixed CVE-2026-53268 in the Linux kernel.
Security Fixed CVE-2026-53269 in the Linux kernel.
Security Fixed CVE-2026-53270 in the Linux kernel.
Security Fixed CVE-2026-53275 in the Linux kernel.

## June 29, 2026

Change

### cos-129-19506-224-80

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.90](https://cos.googlesource.com/third_party/kernel/+/ebd6b5eac866f903f1cc7586ae6291004984e702) | v27.5.1 | v2.2.3 | [See List](https://storage.googleapis.com/cos-tools/19506.224.80/lakitu/gpu_driver_versions.textproto) |

Change Updated cloud-provider-gcp to v35.0.8, docker-credential-gcr to v2.1.32, docker-credential-helpers to v0.9.7, nvidia-container-toolkit to v1.17.9, isa-l to v2.31.1, oauthlib to v3.0.2, apparmor-profiles to v3.1.7, apparmor to v3.1.7, ek-cpu-balloon to v1.2.3, libapparmor to v3.1.7.
Change Updated gzip to v1.14_p20260502, xz-utils to v5.4.7, zstd to v1.5.7, mit-krb5 to v1.22.2, vim to v9.1.2148, vim-core to v9.1.2148, python-exec-conf to v2.4.10, libaio to v0.3.113, xxhash to v0.8.3, PySocks to v1.6.8, cryptography to v39.0.2, markupsafe to v2.1.5, pyrsistent to v0.14.11, python-magic to v0.4.27, pyyaml to v6.0.3, rfc3339-validator to v0.1.4, iptables to v1.8.13, mawk to v1.3.4_p20260302, lvm2 to v2.03.39, binutils-libs to v2.46.1, libxcrypt to v4.4.38, talloc to v2.4.4.
Change Updated libtraceevent to v1.7.3, libtracefs to v1.6.4, conntrack-tools to v1.4.9, fuse to v2.9.9, fuse-common to v3.10.5.
Change Updated sys-apps/casfs to v0.1.14.
Feature Added cos-dkms support for vast client
drivers v4.5.7.
Feature Support nvidia-fs for COS GPU installer
Fixed Upgraded app-admin/sosreport to v4.11.2.
Fixed Upgraded app-shells/dash to v0.5.13.4-r2.
Fixed Upgraded dev-libs/expat to v2.8.1.
Fixed Upgraded net-misc/curl to v8.20.0-r1.
Fixed Upgraded net-misc/rsync to v3.4.4.
Fixed Upgraded sys-apps/gentoo-functions to v1.7.7.
Security Fixed CVE-2026-11822, CVE-2026-11824 in dev-db/sqlite.
Security Fixed CVE-2026-43116 in the Linux kernel.
Security Fixed CVE-2026-45850 in the Linux kernel.
Security Fixed CVE-2026-52908 in the Linux kernel.
Security Fixed CVE-2026-52910 in the Linux kernel.
Security Fixed CVE-2026-52912 in the Linux kernel.
Security Fixed CVE-2026-52920 in the Linux kernel.
Security Fixed CVE-2026-52921 in the Linux kernel.
Security Fixed CVE-2026-52923 in the Linux kernel.
Security Fixed CVE-2026-52925 in the Linux kernel.
Security Fixed CVE-2026-52927 in the Linux kernel.
Security Fixed CVE-2026-52930 in the Linux kernel.
Security Fixed CVE-2026-52936 in the Linux kernel.
Security Fixed CVE-2026-52942 in the Linux kernel.
Security Fixed CVE-2026-52943 in the Linux kernel.
Security Fixed CVE-2026-52969 in the Linux kernel.
Security Fixed CVE-2026-52970 in the Linux kernel.
Security Fixed CVE-2026-52974 in the Linux kernel.
Security Fixed CVE-2026-52977 in the Linux kernel.
Security Fixed CVE-2026-52980 in the Linux kernel.
Security Fixed CVE-2026-52981 in the Linux kernel.
Security Fixed CVE-2026-52984 in the Linux kernel.
Security Fixed CVE-2026-52986 in the Linux kernel.
Security Fixed CVE-2026-52989 in the Linux kernel.
Security Fixed CVE-2026-52990 in the Linux kernel.
Security Fixed CVE-2026-52998 in the Linux kernel.
Security Fixed CVE-2026-52999 in the Linux kernel.
Security Fixed CVE-2026-53001 in the Linux kernel.
Security Fixed CVE-2026-53002 in the Linux kernel.
Security Fixed CVE-2026-53003 in the Linux kernel.
Security Fixed CVE-2026-53006 in the Linux kernel.
Security Fixed CVE-2026-53012 in the Linux kernel.
Security Fixed CVE-2026-53013 in the Linux kernel.
Security Fixed CVE-2026-53014 in the Linux kernel.
Security Fixed CVE-2026-53021 in the Linux kernel.
Security Fixed CVE-2026-53023 in the Linux kernel.
Security Fixed CVE-2026-53031 in the Linux kernel.
Security Fixed CVE-2026-53032 in the Linux kernel.
Security Fixed CVE-2026-53034 in the Linux kernel.
Security Fixed CVE-2026-53035 in the Linux kernel.
Security Fixed CVE-2026-53036 in the Linux kernel.
Security Fixed CVE-2026-53050 in the Linux kernel.
Security Fixed CVE-2026-53060 in the Linux kernel.
Security Fixed CVE-2026-53062 in the Linux kernel.
Security Fixed CVE-2026-53063 in the Linux kernel.
Security Fixed CVE-2026-53064 in the Linux kernel.
Security Fixed CVE-2026-53069 in the Linux kernel.
Security Fixed CVE-2026-53074 in the Linux kernel.
Security Fixed CVE-2026-53075 in the Linux kernel.
Security Fixed CVE-2026-53076 in the Linux kernel.
Security Fixed CVE-2026-53080 in the Linux kernel.
Security Fixed CVE-2026-53083 in the Linux kernel.
Security Fixed CVE-2026-53085 in the Linux kernel.
Security Fixed CVE-2026-53094 in the Linux kernel.
Security Fixed CVE-2026-53096 in the Linux kernel.
Security Fixed CVE-2026-53111 in the Linux kernel.
Security Fixed CVE-2026-53115 in the Linux kernel.
Security Fixed CVE-2026-53120 in the Linux kernel.
Security Fixed CVE-2026-53123 in the Linux kernel.
Security Fixed CVE-2026-53126 in the Linux kernel.
Security Fixed CVE-2026-53129 in the Linux kernel.
Security Fixed CVE-2026-7210 in dev-lang/python.
Security Upgraded dev-libs/openssl to v3.5.7 to fix CVE-2026-45447,
CVE-2026-45445,CVE-2026-34183,CVE-2026-42764,CVE-2026-7383,CVE-2026-34180,
CVE-2026-34182,CVE-2026-34181,CVE-2026-9076.

## June 22, 2026

Change

### cos-129-19506-224-52

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.90](https://cos.googlesource.com/third_party/kernel/+/fd31f7d8b65031d8f8a98c7aafc59c84a831dfc0) | v27.5.1 | v2.2.3 | [See List](https://storage.googleapis.com/cos-tools/19506.224.52/lakitu/gpu_driver_versions.textproto) |

Announcement Minor changes.

## June 18, 2026

Change

### cos-129-19506-224-49

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.90](https://cos.googlesource.com/third_party/kernel/+/fd31f7d8b65031d8f8a98c7aafc59c84a831dfc0) | v27.5.1 | v2.2.3 | [See List](https://storage.googleapis.com/cos-tools/19506.224.49/lakitu/gpu_driver_versions.textproto) |

Change Updated oslogin to v20260605.00.
Fixed Upgraded app-admin/logrotate to v3.22.0-r1.
Fixed Upgraded sys-apps/less to v704.
Security Fix CVE-2026-41567 in app-containers/docker.
Security Fix CVE-2026-41568 in app-containers/docker.
Security Fix CVE-2026-42306 in app-containers/docker.
Security Fixed CVE-2026-46160 in the Linux kernel.
Security Fixed CVE-2026-46315 in the Linux kernel.
Security Fixed CVE-2026-46321 in the Linux kernel.
Security Fixed CVE-2026-46322 in the Linux kernel.
Security Fixed CVE-2026-46323 in the Linux kernel.
Security Fixed CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, and CVE-2026-47262 in app-containers/containerd.

## June 15, 2026

Change

### cos-129-19506-224-36

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.90](https://cos.googlesource.com/third_party/kernel/+/fac8e2b17485d0065f6f69f83ddb8eb0e9d9c55a) | v27.5.1 | v2.2.3 | [See List](https://storage.googleapis.com/cos-tools/19506.224.36/lakitu/gpu_driver_versions.textproto) |

Fixed Upgraded app-admin/fluent-bit to v4.2.5.
Fixed Upgraded cos-gpu-installer to v2.7.3.
Fixed Upgraded sys-apps/less to v702.
Security Fixed CVE-2025-71289 in the Linux kernel.
Security Fixed CVE-2026-43245 in the Linux kernel.
Security Fixed CVE-2026-43503 in the Linux kernel.
Security Fixed CVE-2026-45838 in the Linux kernel.
Security Fixed CVE-2026-45839 in the Linux kernel.
Security Fixed CVE-2026-45841 in the Linux kernel.
Security Fixed CVE-2026-45842 in the Linux kernel.
Security Fixed CVE-2026-45843 in the Linux kernel.
Security Fixed CVE-2026-45844 in the Linux kernel.
Security Fixed CVE-2026-46243 in the Linux kernel.
Security Fixed CVE-2026-46244 in the Linux kernel.
Security Fixed CVE-2026-46274 in the Linux kernel.
Security Fixed CVE-2026-46300 in the Linux kernel.
Security Fixed CVE-2026-46316 in the Linux kernel.
Security Fixed KCTF-def602e in the Linux kernel.
Security Fixed KCTF-e5b31d9 in the Linux kernel.
Security Updated dev-python/pyjwt to v2.13.0. This fixes
CVE-2026-48522, CVE-2026-48524, CVE-2026-48525, CVE-2026-485256.

## June 08, 2026

Change

### cos-129-19506-224-16

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.90](https://cos.googlesource.com/third_party/kernel/+/e06aec09f8bd1eace9b1d1adb0ec84899e9a05f5) | v27.5.1 | v2.2.3 | [See List](https://storage.googleapis.com/cos-tools/19506.224.16/lakitu/gpu_driver_versions.textproto) |

Change Updated minijail to r188.
Security Fixed CVE-2026-43303 in the Linux kernel.

## June 01, 2026

Change

### cos-129-19506-224-7

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.90](https://cos.googlesource.com/third_party/kernel/+/ee5c0e72ce4f921969d64843af4f37b1e22a9738) | v27.5.1 | v2.2.3 | [See List](https://storage.googleapis.com/cos-tools/19506.224.7/lakitu/gpu_driver_versions.textproto) |

Change Runtime sysctl changes:

- Changed: net.ipv4.udp_mem: 188034 250714 376068 -\> 188034 250715 376068

<br />

Fixed Added support for NVIDIA driver v580.159.04.

## May 26, 2026

Change

### cos-129-19506-120-115

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.77](https://cos.googlesource.com/third_party/kernel/+/4b67db877bccca1607f98ab4fd34f80e6245828f) | v27.5.1 | v2.2.3 | [See List](https://storage.googleapis.com/cos-tools/19506.120.115/lakitu/gpu_driver_versions.textproto) |

Announcement This update contains several package upgrades to the latest patch version to ensure security, along with package patches for known CVEs.
Change Added support for the `swiotlb=any` kernel command line parameter.
Change Update sys-process/audit to v3.0.9.
Change Updated glib to v2.86.5.
Change Updated sys-libs/pam to v1.5.3.
Change Upgraded net-misc/openssh to v10.0_p2.
Fixed Fixed a crash that occurs when using the `configfile` or
`source` GRUB2 commands when Secure Boot is enabled.
Fixed Fixed a race condition triggered by ext4 online resize that
rarely causes machines to fail to boot.
Fixed Upgraded cos-gpu-installer to v2.7.2.
Security Fixed CVE-2026-23171 in the Linux kernel.
Security Fixed CVE-2026-31419 in the Linux kernel.
Security Fixed CVE-2026-31430 in the Linux kernel.
Security Fixed CVE-2026-31709 in the Linux kernel.
Security Fixed CVE-2026-43074 in the Linux kernel.
Security Fixed CVE-2026-43088 in the Linux kernel.
Security Fixed CVE-2026-44431 in dev-python/urllib3.
Security Fixed CVE-2026-6732 in dev-libs/libxml2.
Security Fixed EFI variable OOB read in grub config parsing.
Security Fixed KCTF-9e6bf14 in the Linux kernel.
Security Updated dev-lang/go to 1.25.10. This fixes CVE-2026-32289,CVE-2026-32282,CVE-2026-32288,CVE-2026-27142,CVE-2025-61728,CVE-2026-27139,CVE-2026-39817,CVE-2026-39819,CVE-2025-68119,CVE-2025-61732,CVE-2026-32280,CVE-2026-25679,CVE-2026-27144,CVE-2026-32283,CVE-2026-27140,CVE-2025-61731,CVE-2026-32281,CVE-2025-61726,CVE-2025-68121,CVE-2026-27143,CVE-2026-39826,CVE-2026-39823,CVE-2026-39825,CVE-2026-33814,CVE-2026-39820,CVE-2026-42499,CVE-2026-39836.
Security Updated net-misc/curl to v8.20. This fixes CVE-2026-5545,CVE-2026-4873,CVE-2026-6429,CVE-2026-7168,CVE-2026-6253,CVE-2026-6276,CVE-2026-7009,CVE-2026-5773.

## May 21, 2026

Change

### cos-129-19506-120-97

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.77](https://cos.googlesource.com/third_party/kernel/+/dfd76308ba62f00253b0f99cf10089931d12241d) | v27.5.1 | v2.2.3 | [See List](https://storage.googleapis.com/cos-tools/19506.120.97/lakitu/gpu_driver_versions.textproto) |

Change Switch cchost-\* boards to legacy iptables.
Fixed Added support for NVIDIA driver v535.309.01.
Fixed Added support for NVIDIA driver v580.159.03.
Fixed Added support for NVIDIA driver v595.71.05.
Fixed Upgraded app-shells/dash to v0.5.13.4.
Fixed Upgraded cos-gpu-installer to v2.7.1.
Fixed Upgraded net-misc/rsync to v3.4.2.
Security Fixed CVE-2025-38584 in the Linux kernel.
Security Fixed CVE-2026-23473 in the Linux kernel.
Security Fixed CVE-2026-43060 in the Linux kernel.
Security Fixed CVE-2026-43063 in the Linux kernel.
Security Fixed CVE-2026-43065 in the Linux kernel.
Security Fixed CVE-2026-43066 in the Linux kernel.
Security Fixed CVE-2026-43067 in the Linux kernel.
Security Fixed CVE-2026-43068 in the Linux kernel.
Security Fixed CVE-2026-43071 in the Linux kernel.
Security Fixed CVE-2026-43073 in the Linux kernel.
Security Fixed CVE-2026-43079 in the Linux kernel.
Security Fixed CVE-2026-43085 in the Linux kernel.
Security Fixed CVE-2026-43086 in the Linux kernel.
Security Fixed CVE-2026-43089 in the Linux kernel.
Security Fixed CVE-2026-43090 in the Linux kernel.
Security Fixed CVE-2026-43091 in the Linux kernel.
Security Fixed CVE-2026-43093 in the Linux kernel.
Security Fixed CVE-2026-43094 in the Linux kernel.
Security Fixed CVE-2026-43099 in the Linux kernel.
Security Fixed CVE-2026-43107 in the Linux kernel.
Security Fixed CVE-2026-43112 in the Linux kernel.
Security Fixed CVE-2026-43114 in the Linux kernel.
Security Fixed CVE-2026-43117 in the Linux kernel.
Security Fixed CVE-2026-43329 in the Linux kernel.
Security Fixed CVE-2026-43332 in the Linux kernel.
Security Fixed CVE-2026-43333 in the Linux kernel.
Security Fixed CVE-2026-43336 in the Linux kernel.
Security Fixed CVE-2026-43338 in the Linux kernel.
Security Fixed CVE-2026-43339 in the Linux kernel.
Security Fixed CVE-2026-43341 in the Linux kernel.
Security Fixed CVE-2026-43350 in the Linux kernel.
Security Fixed CVE-2026-43359 in the Linux kernel.
Security Fixed CVE-2026-43360 in the Linux kernel.
Security Fixed CVE-2026-43361 in the Linux kernel.
Security Fixed CVE-2026-43362 in the Linux kernel.
Security Fixed CVE-2026-43363 in the Linux kernel.
Security Fixed CVE-2026-43365 in the Linux kernel.
Security Fixed CVE-2026-43366 in the Linux kernel.
Security Fixed CVE-2026-43374 in the Linux kernel.
Security Fixed CVE-2026-43383 in the Linux kernel.
Security Fixed CVE-2026-43392 in the Linux kernel.
Security Fixed CVE-2026-43393 in the Linux kernel.
Security Fixed CVE-2026-43394 in the Linux kernel.
Security Fixed CVE-2026-43403 in the Linux kernel.
Security Fixed CVE-2026-43409 in the Linux kernel.
Security Fixed CVE-2026-43438 in the Linux kernel.
Security Fixed CVE-2026-43439 in the Linux kernel.
Security Fixed CVE-2026-43441 in the Linux kernel.
Security Fixed CVE-2026-43448 in the Linux kernel.
Security Fixed CVE-2026-43449 in the Linux kernel.
Security Fixed CVE-2026-43450 in the Linux kernel.
Security Fixed CVE-2026-43451 in the Linux kernel.
Security Fixed CVE-2026-43452 in the Linux kernel.
Security Fixed CVE-2026-43453 in the Linux kernel.
Security Fixed CVE-2026-43466 in the Linux kernel.
Security Fixed CVE-2026-43469 in the Linux kernel.
Security Fixed CVE-2026-43470 in the Linux kernel.
Security Fixed CVE-2026-43472 in the Linux kernel.
Security Fixed CVE-2026-43475 in the Linux kernel.
Security Fixed CVE-2026-43482 in the Linux kernel.
Security Fixed CVE-2026-43486 in the Linux kernel.
Security Fixed CVE-2026-43487 in the Linux kernel.
Security Fixed CVE-2026-46333 in the Linux kernel.
Security Fixed argument injection in toolbox.

## May 09, 2026

Change

### cos-beta-129-19506-120-64

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.77](https://cos.googlesource.com/third_party/kernel/+/261ec2a82c20483a919d7d25c05c7138ed1859c8) | v27.5.1 | v2.2.3 | [See List](https://storage.googleapis.com/cos-tools/19506.120.64/lakitu/gpu_driver_versions.textproto) |

Security Fixed CVE-2026-43284 (dirtyfrag) in the Linux kernel.
Change Apply hardening sysctls on cchost boards.
Change Enabled mm hardening kernel cmdlines on cchost.
Security Fixed CVE-2026-23255 in the Linux kernel.
Security Fixed CVE-2026-23302 in the Linux kernel.
Security Fixed CVE-2026-23458 in the Linux kernel.
Security Fixed CVE-2026-31614 in the Linux kernel.
Security Fixed CVE-2026-31694 in the Linux kernel.
Security Fixed CVE-2026-31700 in the Linux kernel.
Security Fixed CVE-2026-31708 in the Linux kernel.
Security Fixed CVE-2026-31716 in the Linux kernel.
Security Fixed CVE-2026-31733 in the Linux kernel.
Security Fixed CVE-2026-31738 in the Linux kernel.
Security Fixed CVE-2026-31752 in the Linux kernel.
Security Fixed CVE-2026-31774 in the Linux kernel.
Security Fixed CVE-2026-31781 in the Linux kernel.
Security Fixed CVE-2026-35385 and CVE-2026-35386 in net-misc/openssh.
Security Fixed CVE-2026-43012 in the Linux kernel.
Security Fixed CVE-2026-43013 in the Linux kernel.
Security Fixed CVE-2026-43016 in the Linux kernel.
Security Fixed CVE-2026-43024 in the Linux kernel.
Security Fixed CVE-2026-43026 in the Linux kernel.
Security Fixed CVE-2026-43027 in the Linux kernel.
Security Fixed CVE-2026-43028 in the Linux kernel.
Security Fixed CVE-2026-43030 in the Linux kernel.
Security Fixed CVE-2026-43035 in the Linux kernel.
Security Fixed CVE-2026-43037 in the Linux kernel.
Security Fixed CVE-2026-43038 in the Linux kernel.
Security Fixed CVE-2026-43040 in the Linux kernel.
Security Fixed CVE-2026-43043 in the Linux kernel.
Security Fixed CVE-2026-43046 in the Linux kernel.
Security Fixed CVE-2026-43054 in the Linux kernel.
Security Fixed CVE-2026-43057 in the Linux kernel.
Security Upgraded cos-gpu-installer to v2.6.8.
Security Upgraded dev-libs/libgcrypt to v1.10.4 to fix CVE-2026-41989.

## May 04, 2026

Change

### cos-beta-129-19506-120-52

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.77](https://cos.googlesource.com/third_party/kernel/+/ab5449e6af743561ec3d078ea8fcec22a07d8e75) | v27.5.1 | v2.2.3 | [See List](https://storage.googleapis.com/cos-tools/19506.120.52/lakitu/gpu_driver_versions.textproto) |

Feature Added the cos_kernel_args tool that allows manipulating kernel command line arguments of a COS image.
Fixed Upgraded app-admin/sosreport to v4.11.1.
Fixed Upgraded app-shells/dash to v0.5.13.3.
Security Fixed CVE-2025-21709 in the Linux kernel.
Security Fixed CVE-2025-22116 in the Linux kernel.
Security Fixed CVE-2025-39764 in the Linux kernel.
Security Fixed CVE-2025-40135 in the Linux kernel.
Security Fixed CVE-2025-68239 in the Linux kernel.
Security Fixed CVE-2025-71161 in the Linux kernel.
Security Fixed CVE-2026-23004 in the Linux kernel.
Security Fixed CVE-2026-23138 in the Linux kernel.
Security Fixed CVE-2026-23157 in the Linux kernel.
Security Fixed CVE-2026-23245 in the Linux kernel.
Security Fixed CVE-2026-23277 in the Linux kernel.
Security Fixed CVE-2026-23368 in the Linux kernel.
Security Fixed CVE-2026-23374 in the Linux kernel.
Security Fixed CVE-2026-23441 in the Linux kernel.
Security Fixed CVE-2026-23442 in the Linux kernel.
Security Fixed CVE-2026-31532 in the Linux kernel.
Security Fixed CVE-2026-31546 in the Linux kernel.
Security Fixed CVE-2026-31554 in the Linux kernel.
Security Fixed CVE-2026-31555 in the Linux kernel.
Security Fixed CVE-2026-31557 in the Linux kernel.
Security Fixed CVE-2026-31561 in the Linux kernel.
Security Fixed CVE-2026-31580 in the Linux kernel.
Security Fixed CVE-2026-31586 in the Linux kernel.
Security Fixed CVE-2026-31588 in the Linux kernel.
Security Fixed CVE-2026-31628 in the Linux kernel.
Security Fixed CVE-2026-31647 in the Linux kernel.
Security Fixed CVE-2026-31648 in the Linux kernel.
Security Fixed CVE-2026-31664 in the Linux kernel.
Security Fixed CVE-2026-31665 in the Linux kernel.
Security Fixed CVE-2026-31667 in the Linux kernel.
Security Fixed CVE-2026-31671 in the Linux kernel.
Security Fixed CVE-2026-31673 in the Linux kernel.
Security Fixed CVE-2026-31675 in the Linux kernel.
Security Fixed CVE-2026-31677 in the Linux kernel.
Security Fixed CVE-2026-31680 in the Linux kernel.
Security Fixed CVE-2026-31681 in the Linux kernel.
Security Fixed CVE-2026-31682 in the Linux kernel.
Security Upgraded dev-libs/openssl to v3.5.6 to fix CVE-2026-28387,
CVE-2026-28388,CVE-2026-28389,CVE-2026-28390,CVE-2026-31790.
Change Runtime sysctl changes:

- Changed: net.ipv4.udp_mem: 188034 250714 376068 -\> 188034 250715 376068

<br />

## May 01, 2026

Change

### cos-beta-129-19506-120-44

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.77](https://cos.googlesource.com/third_party/kernel/+/8656d3e850e89f3430c31b56ebae60096f99a71b) | v27.5.1 | v2.2.3 | [See List](https://storage.googleapis.com/cos-tools/19506.120.44/lakitu/gpu_driver_versions.textproto) |

Change Added support for the R595 Nvidia driver production branch.
Change Made it so that /etc/machine-id is mounted with noexec, nosuid, and nodev.
Feature Enabled CONFIG_SCHED_CLASS_EXT and CONFIG_EXT_GROUP_SCHED.
Fixed Added support for NVIDIA drivers v580.126.16 and v580.126.20.
Fixed Fixed KCTF-42156f9 in the Linux kernel.
Fixed Fixed an ext4/jbd2 performance regression on CPU Node.
Fixed Optimized IOMMU reference counting using atomic64_inc_return().
Fixed Serialized sequence allocation to prevent timeouts during
concurrent TLB invalidations.
Fixed Upgraded sys-apps/makedumpfile to v1.7.9.
Security Fixed CVE-2026-23276 in the Linux kernel.
Security Fixed CVE-2026-23375 in the Linux kernel.
Security Fixed CVE-2026-23391 in the Linux kernel.
Security Fixed CVE-2026-23397 in the Linux kernel.
Security Fixed CVE-2026-23398 in the Linux kernel.
Security Fixed CVE-2026-23399 in the Linux kernel.
Security Fixed CVE-2026-23401 in the Linux kernel.
Security Fixed CVE-2026-23412 in the Linux kernel.
Security Fixed CVE-2026-23413 in the Linux kernel.
Security Fixed CVE-2026-23414 in the Linux kernel.
Security Fixed CVE-2026-23417 in the Linux kernel.
Security Fixed CVE-2026-23439 in the Linux kernel.
Security Fixed CVE-2026-23449 in the Linux kernel.
Security Fixed CVE-2026-23452 in the Linux kernel.
Security Fixed CVE-2026-23455 in the Linux kernel.
Security Fixed CVE-2026-23456 in the Linux kernel.
Security Fixed CVE-2026-23457 in the Linux kernel.
Security Fixed CVE-2026-23465 in the Linux kernel.
Security Fixed CVE-2026-23471 in the Linux kernel.
Security Fixed CVE-2026-31392 in the Linux kernel.
Security Fixed CVE-2026-31400 in the Linux kernel.
Security Fixed CVE-2026-31402 in the Linux kernel.
Security Fixed CVE-2026-31403 in the Linux kernel.
Security Fixed CVE-2026-31406 in the Linux kernel.
Security Fixed CVE-2026-31407 in the Linux kernel.
Security Fixed CVE-2026-31413 in the Linux kernel.
Security Fixed CVE-2026-31414 in the Linux kernel.
Security Fixed CVE-2026-31415 in the Linux kernel.
Security Fixed CVE-2026-31416 in the Linux kernel.
Security Fixed CVE-2026-31418 in the Linux kernel.
Security Fixed CVE-2026-31421 in the Linux kernel.
Security Fixed CVE-2026-31423 in the Linux kernel.
Security Fixed CVE-2026-31424 in the Linux kernel.
Security Fixed CVE-2026-31426 in the Linux kernel.
Security Fixed CVE-2026-31427 in the Linux kernel.
Security Fixed CVE-2026-31428 in the Linux kernel.
Security Fixed CVE-2026-31431 (copy.fail) in the Linux kernel.
Security Fixed CVE-2026-31434 in the Linux kernel.
Security Fixed CVE-2026-31438 in the Linux kernel.
Security Fixed CVE-2026-31446 in the Linux kernel.
Security Fixed CVE-2026-31447 in the Linux kernel.
Security Fixed CVE-2026-31448 in the Linux kernel.
Security Fixed CVE-2026-31449 in the Linux kernel.
Security Fixed CVE-2026-31450 in the Linux kernel.
Security Fixed CVE-2026-31451 in the Linux kernel.
Security Fixed CVE-2026-31452 in the Linux kernel.
Security Fixed CVE-2026-31453 in the Linux kernel.
Security Fixed CVE-2026-31454 in the Linux kernel.
Security Fixed CVE-2026-31455 in the Linux kernel.
Security Fixed CVE-2026-31466 in the Linux kernel.
Security Fixed CVE-2026-31469 in the Linux kernel.
Security Fixed CVE-2026-31495 in the Linux kernel.
Security Fixed CVE-2026-31496 in the Linux kernel.
Security Fixed CVE-2026-31515 in the Linux kernel.
Security Fixed CVE-2026-31516 in the Linux kernel.
Security Fixed CVE-2026-31519 in the Linux kernel.
Security Fixed CVE-2026-31521 in the Linux kernel.
Security Fixed CVE-2026-31523 in the Linux kernel.
Security Fixed CVE-2026-31525 in the Linux kernel.
Security Fixed CVE-2026-31528 in the Linux kernel.
Security Fixed CVE-2026-31531 in the Linux kernel.
Security Fixed CVE-2026-32280, CVE-2026-32281, CVE-2026-32283,
CVE-2026-27140, CVE-2026-27144 in dev-lang/go.
Security Fixed CVE-2026-34743 in app-arch/xz-utils.
Security Fixed CVE-2026-4046 in sys-libs/glibc.
Security Fixed KCTF-42156f9 in the Linux kernel.
Change Runtime sysctl changes:

- Changed: net.ipv4.udp_mem: 188034 250715 376068 -\> 188034 250714 376068

<br />

## April 27, 2026

Change

### cos-beta-129-19506-120-15

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.77](https://cos.googlesource.com/third_party/kernel/+/494b0342b38b614242985fa139fc510253b3b81f) | v27.5.1 | v2.2.3 | [See List](https://storage.googleapis.com/cos-tools/19506.120.15/lakitu/gpu_driver_versions.textproto) |

Fixed Upgraded app-admin/fluent-bit to v4.2.4.
Fixed Upgraded sys-apps/pv to v1.10.4.
Fixed Upgraded sys-process/lsof to v4.99.6.
Security Fixed CVE-2026-0994 in dev-libs/protobuf.
Security Fixed CVE-2026-35414 in net-misc/openssh.
Security Fixed CVE-2026-4437,CVE-2026-4438 in sys-libs/glibc.
Security Fixed KCTF-7e3955b in the Linux kernel.
Security Fixed KCTF-a9b8b18 in the Linux kernel.
Security Upgrdaed containerd to v2.2.3. This fixes CVE-2026-35469.

## April 13, 2026

Change

### cos-beta-129-19506-0-140

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.77](https://cos.googlesource.com/third_party/kernel/+/3dee22804a41a202d6d8646c9504236d05170730) | v27.5.1 | v2.2.2 | [See List](https://storage.googleapis.com/cos-tools/19506.0.140/lakitu/gpu_driver_versions.textproto) |

Announcement This is an [LTS Refresh release.](https://docs.cloud.google.com/container-optimized-os/docs/concepts/versioning.md.txt#lts_refresh_releases)
Change Added support for 8th generation TPU devices.
Change Fixed CVE-2026-33997 and CVE-2026-34040 in Docker.
Change Upgraded sys-apps/iproute2 to version 6.18.0.
Feature Changed default sysctl networking values on A4x-max machine type only.
Feature Reverted iproute2 to v5.16.0.
Fixed Fixed a kernel panic in virtio_pci teardown when virtual queues are conditionally skipped.
Fixed Upgraded app-shells/dash to v0.5.13.2.
Fixed Upgraded dev-db/sqlite to v3.51.2.
Fixed Upgraded net-misc/rsync to v3.4.1-r3.
Fixed Upgraded net-misc/socat to v1.8.1.1.
Fixed Upgraded sys-apps/hwdata to v0.401.
Fixed Upgraded sys-process/procps to v4.0.6.
Fixed Upgraded virtual/logger to v0-r3.
Security Fixed CVE-2024-14027 in the Linux kernel.
Security Fixed CVE-2026-23270 in the Linux kernel.
Security Fixed KCTF-7cb9a23 in the Linux kernel.

## April 06, 2026

Change

### cos-beta-129-19506-0-121

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.67](https://cos.googlesource.com/third_party/kernel/+/3c72f15648aedcf11689537f9545addd4377da5f) | v27.5.1 | v2.2.2 | [See List](https://storage.googleapis.com/cos-tools/19506.0.121/lakitu/gpu_driver_versions.textproto) |

Change Upgraded sys-apps/iproute2 to version 6.18.0.
Fixed Fixed a kernel panic in virtio_pci teardown when virtually queues are conditionally skipped.
Security Fixed CVE-2024-14027 in the Linux kernel.
Security Fixed CVE-2026-23270 in the Linux kernel.
Security Fixed KCTF-7cb9a23 in the Linux kernel.

## April 01, 2026

Change

### cos-beta-129-19506-0-115

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.67](https://cos.googlesource.com/third_party/kernel/+/808b921cc891c1cb66519d4374662823bfe1713a) | v27.5.1 | v2.2.2 | [See List](https://storage.googleapis.com/cos-tools/19506.0.115/lakitu/gpu_driver_versions.textproto) |

Security Fixed CVE-2024-14027 in the Linux kernel.
Security Fixed KCTF-7cb9a23 in the Linux kernel.

## March 30, 2026

Change

### cos-beta-129-19506-0-109

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.67](https://cos.googlesource.com/third_party/kernel/+/82c29e7c6b260a76fdf55a67f4339c2bcb44b824) | v27.5.1 | v2.2.2 | [See List](https://storage.googleapis.com/cos-tools/19506.0.109/lakitu/gpu_driver_versions.textproto) |

Change Fixed CVE-2026-27135 in net-libs/nghttp2.
Feature Enabled dynamic configuration of FUSE max pages limit.
Security Fixed CVE-2026-23292 in the Linux kernel.
Security Fixed CVE-2026-23293 in the Linux kernel.
Security Fixed CVE-2026-23296 in the Linux kernel.
Security Fixed CVE-2026-23297 in the Linux kernel.
Security Fixed CVE-2026-23300 in the Linux kernel.
Security Fixed CVE-2026-23303 in the Linux kernel.
Security Fixed CVE-2026-23304 in the Linux kernel.
Security Fixed CVE-2026-23310 in the Linux kernel.
Security Fixed CVE-2026-23316 in the Linux kernel.
Security Fixed CVE-2026-23319 in the Linux kernel.
Security Fixed CVE-2026-23340 in the Linux kernel.
Security Fixed CVE-2026-23352 in the Linux kernel.
Security Fixed CVE-2026-23359 in the Linux kernel.
Security Fixed CVE-2026-23360 in the Linux kernel.
Security Fixed CVE-2026-23380 in the Linux kernel.
Security Fixed CVE-2026-23381 in the Linux kernel.
Security Fixed CVE-2026-23383 in the Linux kernel.
Security Fixed CVE-2026-23388 in the Linux kernel.
Security Fixed CVE-2026-23390 in the Linux kernel.
Security Fixed KCTF-9df9578 in the Linux kernel.
Change Runtime sysctl changes:

- Added: fs.fuse.max_pages_limit: 256

<br />

## March 26, 2026

Change

### cos-beta-129-19506-0-98

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.67](https://cos.googlesource.com/third_party/kernel/+/665d2061d21ae56123f4de285c75962c6cf56b91) | v27.5.1 | v2.2.2 | [See List](https://storage.googleapis.com/cos-tools/19506.0.98/lakitu/gpu_driver_versions.textproto) |

Change Added support for the Lustre 2.14.0_p249 drivers.
Change Fixed CVE-2026-32597 with pyjwt package upgrade to 2.12.1.
Feature Added support for loading the ublk kernel module.
Fixed Fixed an ek-cpu-balloon bug which would result in CPUs being underreported on ek machines with SMT enabled.
Fixed Upgraded app-admin/google-osconfig-agent to v20260119.00.
Security Fixed CVE-2025-71265 in the Linux kernel.
Security Fixed CVE-2025-71266 in the Linux kernel.
Security Fixed CVE-2025-71267 in the Linux kernel.
Security Fixed CVE-2025-71268 in the Linux kernel.
Security Fixed CVE-2026-23069 in the Linux kernel.
Security Fixed CVE-2026-23083 in the Linux kernel.
Security Fixed CVE-2026-23085 in the Linux kernel.
Security Fixed CVE-2026-23086 in the Linux kernel.
Security Fixed CVE-2026-23095 in the Linux kernel.
Security Fixed CVE-2026-23097 in the Linux kernel.
Security Fixed CVE-2026-23099 in the Linux kernel.
Security Fixed CVE-2026-23103 in the Linux kernel.
Security Fixed CVE-2026-23105 in the Linux kernel.
Security Fixed CVE-2026-23107 in the Linux kernel.
Security Fixed CVE-2026-23110 in the Linux kernel.
Security Fixed CVE-2026-23243 in the Linux kernel.
Security Fixed CVE-2026-23254 in the Linux kernel.
Security Fixed CVE-2026-23262 in the Linux kernel.
Security Fixed KCTF-329f0b9 in the Linux kernel.
Security Fixed KCTF-c9bc175 in the Linux kernel.
Security Updated dev-libs/openssl to v3.5.5. This resolves CVE-2025-15467.
Security Updated net-misc/curl to v8.19.0. This resolves CVE-2026-1965 and CVE-2026-3783.
Security Updated sys-libs/binutils-libs to 2.46.0. This resolves CVE-2025-69644.

## March 17, 2026

Change

### cos-beta-129-19506-0-66

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.67](https://cos.googlesource.com/third_party/kernel/+/e2ad9be2a74b62aaf49320d42f7a9ca47132ad5e) | v27.5.1 | v2.2.2 | [See List](https://storage.googleapis.com/cos-tools/19506.0.66/lakitu/gpu_driver_versions.textproto) |

Change Added support for the Lustre 2.14.0_p246 drivers.
Change Fixed the "CrackArmor" vulnerability in the Linux kernel.
Breaking `/dev/hugepages` is now mounted with the `noexec` option.
Breaking `/run` is now mounted with the `noexec` option.
Change Updated cos-gpu-installer to v2.6.0.
Change Upgraded CASFS to v0.1.2.
Change Upgraded app-containers/containerd to v2.2.2.
Change Upgraded dev-libs/glib to v2.86.3. This fixes CVE-2025-14087, CVE-2025-14512 and CVE-2025-13601.
Feature Added support for larger ring sizes for the GVNIC driver in DQO-QPL mode.
Fixed Enabled buffer overflow detection for kernel str/mem functions.
Fixed Fixed a kernel bug which could cause traffic drops after NIC resets.
Fixed Fixed performance and efficiency issues in TCPX through optimized netmem handling and scatter-gather list coalescing for large memory mappings.
Fixed Updated cos-gpu-installer to v2.6.1.
Fixed Upgraded app-admin/fluent-bit to v4.2.3.1.
Fixed Upgraded app-admin/sosreport to v4.11.0.
Fixed Upgraded dev-util/gdbus-codegen to v2.86.3.
Fixed Upgraded the galog version to v0.0.0-20250924170816-9dbf105986f4 in google-guest-agent to fix an issue with high CPU consumption.
Security Fixed CVE-2026-23229 in the Linux kernel.
Security Fixed CVE-2026-23230 in the Linux kernel.
Security Fixed CVE-2026-23240 in the Linux kernel.
Security Fixed a packet header clobbering issue in the IDPF driver occurring when SWIOTLB and header split are enabled.
Security Fixed KCTF-71e99ee in the Linux kernel.

## February 24, 2026

Change

### cos-beta-129-19506-0-32

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.67](https://cos.googlesource.com/third_party/kernel/+/db611b456979827c0f71190bd2fd9868cec57510) | v27.5.1 | v2.2.0 | [See List](https://storage.googleapis.com/cos-tools/19506.0.32/lakitu/gpu_driver_versions.textproto) |

Change Upgraded net-misc/curl to version 8.18.0. This fixes CVE-2025-13034, CVE-2025-14017, CVE-2025-14524, CVE-2025-14819, CVE-2025-15079, and CVE-2025-15224.
Feature Added support for 590.44.01 and 590.48.01 NVIDIA driver for NVIDIA_RTX_PRO_6000
Fixed Added support for NVIDIA driver v580.126.09-grid for NVIDIA_RTX_PRO_6000 GPU type.
Security Fixed CVE-2025-15281 and CVE-2026-0861 in sys-libs/glibc.
Security Fixed CVE-2025-68358 in the Linux kernel.
Security Fixed CVE-2025-68365 in the Linux kernel.
Security Fixed CVE-2025-68725 in the Linux kernel.
Security Fixed CVE-2025-71225 in the Linux kernel.
Security Fixed CVE-2026-23112 in the Linux kernel.
Security Fixed CVE-2026-23113 in the Linux kernel.
Security Fixed CVE-2026-23119 in the Linux kernel.
Security Fixed CVE-2026-23124 in the Linux kernel.
Security Fixed CVE-2026-23148 in the Linux kernel.
Security Fixed CVE-2026-23154 in the Linux kernel.
Security Fixed CVE-2026-23156 in the Linux kernel.
Security Fixed CVE-2026-23159 in the Linux kernel.
Security Fixed CVE-2026-23161 in the Linux kernel.
Security Fixed CVE-2026-23168 in the Linux kernel.
Security Fixed CVE-2026-23173 in the Linux kernel.
Security Fixed CVE-2026-23177 in the Linux kernel.
Security Fixed CVE-2026-23179 in the Linux kernel.
Security Fixed CVE-2026-23193 in the Linux kernel.
Security Fixed CVE-2026-23198 in the Linux kernel.
Security Fixed CVE-2026-23199 in the Linux kernel.
Security Fixed CVE-2026-23200 in the Linux kernel.
Security Fixed CVE-2026-23204 in the Linux kernel.
Security Fixed CVE-2026-23205 in the Linux kernel.
Security Fixed CVE-2026-23212 in the Linux kernel.
Security Fixed CVE-2026-23214 in the Linux kernel.
Security Fixed CVE-2026-23215 in the Linux kernel.
Security Fixed CVE-2026-23216 in the Linux kernel.
Security Fixed CVE-2026-23219 in the Linux kernel.
Security Fixed KCTF-e3f000f in the Linux kernel.

## February 20, 2026

Change

### cos-beta-129-19506-0-17

|---|---|---|---|
| Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) |
| [COS-6.12.67](https://cos.googlesource.com/third_party/kernel/+/6a94838554b0bb000df16504d3a1e893f6822085) | v27.5.1 | v2.2.0 | [See List](https://storage.googleapis.com/cos-tools/19506.0.17/lakitu/gpu_driver_versions.textproto) |

Breaking Removed the root file system copies of kubectl, kubelet, crictl, and
node-problem-detector in GKE only.
Change Added kernel support for bare-metal on the NVIDIA Grace platform.
Change Added support for A4X-Max NICs.
Change Applied ethtool ring length changes to a4x's first Diorite interface.
Change Enabled Coherent Driver Memory Management by default when installing GPU drivers on GB2000.
Change Changed the mount options for /mnt/disks to noexec.
Change Updated CONFIG_BLK_DEV_LOOP_MIN_COUNT to 0. This allows
unlimited loop devices.
Change Updated app-containers/containerd to v2.2.0.
Change Updated app-containers/runc to v1.4.0.
Change Updated dev-libs/openssl to v3.5.4.
Change Updated the Linux kernel to v6.12.67.
Change Upgraded dev-libs/json-c from 0.16-r1 to 0.18.0.
Change Upgraded dev-libs/libuv from 1.43.0 to 1.51.0-r1.
Change Upgraded dev-util/cmake from 3.26.4 to 3.31.9.
Feature Added CPU balloon support for ARM CPUs.
Feature Added ConnectX-8 RDMA support.
Feature Added GB300 support to cos-extensions.
Feature Added GDRCopy kernel module for NVIDIA drivers.
Feature Added IPv6 support for machines using the IDPF driver.
Feature Added TDX RTMR support.
Feature Added guest support for paravirtualization of cpuids on ARM machines.
Feature Added iRDMA support in the Linux kernel.
Feature Added patches to handle IDPF tx timeouts.
Feature Added support for CASFS (Content Addressable Storage File System) as a kernel module.
Feature Added support for NVIDIA GB300 devices.
Feature Added support for NVIDIA MFT Tools on arm64.
Feature Added support for NVIDIA driver v535.288.01, v570.211.01 and v580.126.09.
Feature Added support for NVIDIA driver v580.105.08 and set it as the default version for all GPU types.
Feature Added support for SCSI logging.
Feature Added support for the Lustre 2.14.0_p224 drivers.
Feature Added support for the fwctl subsystem and the Mellanox fwctl driver for ARM64.
Feature Added support for zswap in the Linux kernel.
Feature Backported support for AMD SEV-SNP SVSM vTPM driver and
configfs-tsm addition for extended attestation protocol.
Feature Configured the cos-gpu-installer to use R580 drivers as the
default GPU drivers.
Feature Disabled DNSSEC by default for COS TPU VMs.
Feature Enabled HTCP TCP congestion control algorithm as a module.
Feature Enabled KVM for COS ARM64.
Feature Enabled Software Watchdog as a module.
Feature Enabled automatic loading of RDMA kernel modules when CX-8 devices are detected.
Feature Enabled dynamic vlan configuration for non-primary NICs.
Feature Enabled hardware optimized SHA256 algorithms for x86 machines with SSSE3 and AVX/AVX2 instructions and ARM64 machines with SHA-NI and ARMv8 Crypto Extensions.
Feature Enabled the Btrfs kernel module.
Feature Enabled the google-guest-agent's network management functionality.
Feature Fixed a bug in cos-extensions which would cause GB200 and GB300 devices not to be detected in one code path, which would result in Imex channels not being created by default.
Feature Removed the cloud-final.service dependency on multi-user.target which could delay cloud-init user-data scripts indefinitely when long-running startup scripts are used.
Feature Removed the futility program from the root file system.
Fixed Add support for NVIDIA MFT Tools v4.33.0.
Fixed Added binary auth-provider-gcp.
Fixed Added support for NVIDIA driver v535.274.02 and v570.195.03.
Fixed Added support for the Lustre 2.14.0_p216 drivers.
Fixed Backported various TCPDirect networking fixes.
Fixed Enabled multiport support for CX-8 devices.
Fixed Fixed a TCPX bug which would sometimes incorrectly report devices as being missing when route cache entries were missing or invalidated.
Fixed Fixed a bug where setting MTU above 9000 on ARM systems with a 64k page size would cause IDPF networking to fail.
Fixed Fixed a kernel bug which caused boot to fail for n4 machine types.
Fixed Fixed an issue in app-containers/runc that caused runc to
use more file descriptors than intended.
Fixed Fixed an issue where cpusets cgroups did not work with
cgroup v1 enabled.
Fixed Fixed an issue where the cpuidle driver selected for some
machine types would cause inflated reports of high CPU usage.
Fixed Fixed bcache latency spikes.
Fixed Installed app-misc/c_rehash.
Fixed Made CX-8 NIC naming order deterministic.
Fixed Made the google-guest-agent more resilient to network link
flakes.
Fixed Partially fixed an issue where excessive contention among writeback kworkers when switching a large number of inodes between cgroups could lead to system unresponsiveness.
Fixed Reduced gcr_wait_online retry gap.
Fixed Removed an artifact registry ping that would delay multi-user.target indefinitely for machines with no external IP address.
Fixed Reverted a containerd change which reduced the default soft file descriptor limit for processes in containers to 1024.
Fixed Reverted a containerd change which reduced the default soft file descriptor limit for processes in containers to 1024.
Fixed Updated app-admin/node-problem-detector to 0.8.21.
Fixed Updated app-containers/cni-plugins to 1.7.1.
Fixed Updated app-containers/cri-tools to 1.32.0.
Fixed Updated cos-gpu-installer to v2.5.10.
Fixed Updated dev-python/requests to v2.32.4.
Fixed Updated golang.org/x/crypto, golang.org/x/net, and
golang.org/x/oauth2 in kubelet and kubectl.
Fixed Updated golang.org/x/oauth2, golang.org/x/net, golang.org/x/crypto, and github.com/golang-jwt/jwt/v5 in Docker.
Fixed Updated kubelet and kubectl to v1.35.0.
Fixed Updated net-misc/chrony to v4.8.
Fixed Updated sys-libs/readline to v8.3.
Fixed Updated app-admin/google-osconfig-agent to v20250522.00.
Fixed Updated the dump capture kernel to v6.12.52.
Fixed Updated toolbox container image tag to v20251002.
Fixed Upgraded app-admin/fluent-bit to v4.2.2.
Fixed Upgraded app-admin/node-problem-detector to v0.8.25.
Fixed Upgraded app-admin/oslogin to v20260116.00.
Fixed Upgraded app-admin/sosreport to v4.10.2.
Fixed Upgraded app-admin/sudo to v1.9.17_p2.
Fixed Upgraded app-benchmarks/microbenchmarks to v0.0.1-r21.
Fixed Upgraded app-containers/cni-plugins to v1.9.0.
Fixed Upgraded app-containers/docker-credential-gcr to v2.1.31
Fixed Upgraded app-containers/docker-credential-helpers to v0.9.5.
Fixed Upgraded app-crypt/mit-krb5 from version 1.20.1 to version 1.22.1.
Fixed Upgraded app-emulation/cloud-init to v25.1.4.
Fixed Upgraded app-shells/bash to v5.3.
Fixed Upgraded chromeos-base/chromeos-common-script to v0.0.1-r668.
Fixed Upgraded chromeos-base/chromeos-common-script to v0.0.1-r671.
Fixed Upgraded chromeos-base/debugd-client to v0.0.1-r2737.
Fixed Upgraded chromeos-base/google-breakpad to v2026.01.16.201758-r268.
Fixed Upgraded chromeos-base/minijail to v18-r168.
Fixed Upgraded chromeos-base/power_manager-client to v0.0.1-r2972.
Fixed Upgraded chromeos-base/session_manager-client to v0.0.1-r2833.
Fixed Upgraded chromeos-base/shill-client to v0.0.1-r4879.
Fixed Upgraded dev-db/sqlite to v3.50.3.
Fixed Upgraded dev-db/sqlite to v3.50.4.
Fixed Upgraded dev-db/sqlite to v3.51.1.
Fixed Upgraded dev-lang/go to v1.23.11.
Fixed Upgraded dev-lang/go to v1.23.12.
Fixed Upgraded dev-libs/expat to v2.7.3.
Fixed Upgraded dev-libs/libxslt to version 1.1.43-r1.
Fixed Upgraded dev-libs/nss to 3.117 and dev-libs/nspr to 4.37.
Fixed Upgraded dev-libs/openssl to 3.5.1.
Fixed Upgraded dev-python/coverage to v7.10.7.
Fixed Upgraded google-guest-configs to v20260121.00.
Fixed Upgraded net-dns/c-ares to v1.34.6.
Fixed Upgraded net-libs/gnutls to v3.8.11.
Fixed Upgraded net-libs/libtirpc to v1.3.7-r2.
Fixed Upgraded net-misc/curl from 8.12.1 to 8.17.0.
Fixed Upgraded net-misc/openssh to 10.0_p1.
Fixed Upgraded net-misc/rsync to v3.4.1-r2.
Fixed Upgraded net-misc/socat to v1.8.1.0-r1.
Fixed Upgraded net-misc/wget to v1.25.0-r1.
Fixed Upgraded net-nds/rpcbind to v1.2.8.
Fixed Upgraded sys-apps/dmidecode to v3.7.
Fixed Upgraded sys-apps/file to v5.46-r3.
Fixed Upgraded sys-apps/gentoo-functions to v1.7.4.
Fixed Upgraded sys-apps/hwdata to v0.400.
Fixed Upgraded sys-apps/kmod to v34.2.
Fixed Upgraded sys-apps/less to v692.
Fixed Upgraded sys-apps/makedumpfile to v1.7.8.
Fixed Upgraded sys-apps/nvme-cli from version 1.6-r1 to version 2.16, added package sys-libs/libnvme.
Fixed Upgraded sys-apps/pv to v1.10.1.
Fixed Upgraded sys-apps/pv to v1.10.2.
Fixed Upgraded sys-apps/pv to v1.10.3.
Fixed Upgraded sys-apps/pv to v1.9.34.
Fixed Upgraded sys-apps/pv to v1.9.42.
Fixed Upgraded sys-apps/pv to v1.9.44.
Fixed Upgraded sys-auth/pambase to v20251104.
Fixed Upgraded sys-libs/libcap to v2.77.
Fixed Upgraded sys-libs/libseccomp to v2.6.0-r3.
Fixed Upgraded sys-process/audit to 4.0.2-r1.
Fixed Upgraded sys-process/lsof to v4.99.5.
Fixed Upgraded sys-process/procps to v4.0.5-r3.
Fixed Upgraded virtual/logger to v0-r2.
Fixed upgraded net-fs/cifs-utils to v7.4.
Security Added support for Nvidia driver version 535.261.03. This fixes CVE-2025-23286 and CVE-2025-23279.
Security Added support for Nvidia driver version 570.172.08. This fixes CVE-2025-23279.
Security Fixed CVE-2025-11081, CVE-2025-11082 and CVE-2025-11083 in sys-libs/binutils-libs.
Security Fixed CVE-2025-11412 in binutils-libs.
Security Fixed CVE-2025-11413 and CVE-2025-11414 in binutils-libs.
Security Fixed CVE-2025-11494 in binutils-libs.
Security Fixed CVE-2025-11495 in binutils-libs.
Security Fixed CVE-2025-12084 in dev-lang/python.
Security Fixed CVE-2025-13836 in dev-lang/python.
Security Fixed CVE-2025-13837 in dev-lang/python.
Security Fixed CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881 in
app-containers/runc.
Security Fixed CVE-2025-40147 in the Linux kernel.
Security Fixed CVE-2025-40212 in the Linux kernel.
Security Fixed CVE-2025-40256 in the Linux kernel.
Security Fixed CVE-2025-47914 and CVE-2025-58181 in dev-go/crypto.
Security Fixed CVE-2025-6052 in dev-libs/glib.
Security Fixed CVE-2025-61727 in dev-lang/go.
Security Fixed CVE-2025-61729 in dev-lang/go.
Security Fixed CVE-2025-66471 and CVE-2025-66418 in dev-python/urllib3.
Security Fixed CVE-2025-8058 in glibc.
Security Fixed CVE-2026-21441 in dev-python/urllib3.
Security Fixed KCTF-01d3c84 in the Linux kernel.
Security Fixed KCTF-134121b in the Linux kernel.
Security Fixed KCTF-2397e92 in the Linux kernel.
Security Fixed KCTF-50da4b9 in the Linux kernel.
Security Fixed KCTF-60e6489 in the Linux Kernel.
Security Fixed KCTF-6bb73db in the Linux Kernel.
Security Fixed KCTF-abad3d0 in the Linux kernel.
Security Fixed KCTF-b441cf3 in the Linux kernel.
Security Fixed KCTF-f41c5d1 in the Linux kernel.
Security Fixed KCTF-f8db647 in the Linux kernel.
Security Updated dev-libs/libxml2 to version 2.14.6. This resolves CVE-2025-6021.
Security Updated dev-python/jinja to v3.1.6. This resolves
CVE-2024-56326, CVE-2024-56201 and CVE-2025-27516.
Security Updated dev-python/urllib3 to v2.5.0. This resolves
CVE-2025-50181.
Security Updated sys-apps/coreutils to v9.5. This resolves
CVE-2024-0684.
Security Upgraded dev-libs/glib to 2.82.5. This resolves
CVE-2024-52533.
Security Upgraded dev-vcs/git to version 2.49.1. This fixes CVE-2025-48385, CVE-2025-27613, CVE-2025-27614, CVE-2025-48384, CVE-2025-46835.
Security Upgraded net-misc/netplan to 1.1.2. This fixes
CVE-2022-4968.
Security Upgraded open-vm-tools to 13.0.5. This fixes CVE-2025-41244 in anthos variant.
Security Upgraded sys-libs/binutils-libs to version 2.45. This fixes CVE-2025-8224,CVE-2025-8225 and CVE-2025-1153.
Security Upgraded urllib3 to version 1.26.18. This fixes CVE-2021-33503, CVE-2023-43804, and CVE-2023-45803.
Security Upgraded vim \& vim-core to version 9.1.1652. This fixes
CVE-2025-53905, CVE-2025-53906, CVE-2025-9390.
Change Runtime sysctl changes:

- Changed: net.ipv4.udp_mem: 188034 250714 376068 -\> 188034 250715 376068

<br />