You can see the latest product updates for all of Google Cloud on the
[Google Cloud](https://docs.cloud.google.com/release-notes) page, browse and filter all release notes in the
[Google Cloud console](https://console.cloud.google.com/release-notes),
or programmatically access release notes in
[BigQuery](https://console.cloud.google.com/bigquery?p=bigquery-public-data&d=google_cloud_release_notes&t=release_notes&page=table).

To get the latest product updates delivered to you, add the URL of this page to your
[feed
reader](https://wikipedia.org/wiki/Comparison_of_feed_aggregators), or add the
[feed URL](https://docs.cloud.google.com/feeds/cos-97-release-notes.xml) directly.

## March 27, 2024

Change

### cos-97-16919-450-41

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.208](https://cos.googlesource.com/third_party/kernel/+/888f6019304c56d32ff9a3d14a09b32683e00a02) | v20.10.24 | v1.6.21 | v470.239.06(default),v535.161.07(latest) |

Security Fixed CVE-2023-52443 in the Linux kernel.
Security Fixed CVE-2024-26585 in the Linux kernel.
Security Fixed CVE-2024-26589 in the Linux kernel.
Security Fixed CVE-2023-52435 in the Linux kernel.
Security Fixed CVE-2023-52434 in the Linux kernel.
Security Fixed CVE-2023-52439 in the Linux kernel.
Fixed Fixed bug in google-guest-agent service enablement.

## March 20, 2024

Change

### cos-97-16919-450-34

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.208](https://cos.googlesource.com/third_party/kernel/+/6e8448271551ff2b91eb46dfbfb8e14b8ef4ea22) | v20.10.24 | v1.6.21 | v470.239.06(default),v535.161.07(latest) |

Security Updated app-editors/vim to 9.0.2167. This fixed CVE-2023-48231, CVE-2023-48232, CVE-2023-48233, CVE-2023-48234, CVE-2023-48235, CVE-2023-48236, CVE-2023-48237, CVE-2023-48706, CVE-2024-22667.
Security Fixed CVE-2024-0727 in dev-libs/openssl.
Security Fixed CVE-2023-52447 in the Linux kernel.

## March 11, 2024

Change

### cos-97-16919-450-30

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.208](https://cos.googlesource.com/third_party/kernel/+/4179bb7a4e833bdae96dd81f6bd700414803f5f8) | v20.10.24 | v1.6.21 | v470.239.06(default),v535.161.07(latest) |

Feature Updated cos-gpu-installer to v2.2.1. Fixed cached driver installation error with network disabled. Added force-fallback flag, major version specification for GPU driver installation and fixed ordering of kernel module loading for nvidia-modeset and nvidia-drm
Security Updated NVIDIA GPU drivers to v470.239.06 and v535.161.07. This fixes CVE-2024-0074, CVE-2024-0075 and CVE-2022-42265.

## March 07, 2024

Change

### cos-97-16919-450-26

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.208](https://cos.googlesource.com/third_party/kernel/+/4179bb7a4e833bdae96dd81f6bd700414803f5f8) | v20.10.24 | v1.6.21 | v470.223.02 (default),v535.154.05(latest),v470.223.02(R470 for compatibility with K80 GPUs) |

Security Fixed CVE-2022-3567 in the Linux kernel.
Security Fixed CVE-2022-3566 in the Linux kernel.
Security Updated dev-libs/libxml2 to version 2.11.7. This fixes CVE-2024-25062.
Security Fixed CVE-2024-23851 in the Linux kernel.
Security Fixed CVE-2024-26581 in the Linux kernel.
Security Upgraded net-misc/curl to version 8.6.0. This fixes CVE-2024-0853.

## February 12, 2024

Change

### cos-97-16919-450-16

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.208](https://cos.googlesource.com/third_party/kernel/+/a8cd334bb0b7e0adc4b55b99226bb29edba3722e) | v20.10.24 | v1.6.21 | v470.223.02 (default),v535.154.05(latest),v470.223.02(R470 for compatibility with K80 GPUs) |

Security Fixed CVE-2023-5678 in dev-libs/openssl.
Security Fixed CVE-2024-1086 and CVE-2023-46838 in the linux kernel.
Security Fixed CVE-2024-0567 and CVE-2024-0553 in net-libs/gnutls.
Security Fixed CVE-2023-40546, CVE-2023-40547, CVE-2023-40549 and CVE-2023-40551 in sys-boot/shim.
Feature Fragmented nvidia-drivers and nvidia-drivers-open pkg into separate packages per major version.

## February 05, 2024

Change

### cos-97-16919-450-7

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.208](https://cos.googlesource.com/third_party/kernel/+/0ce146dcb28a61f9f9bc1eba7ee69e72ba20bcc7) | v20.10.24 | v1.6.21 | v470.223.02 (default),v535.154.05(latest),v470.223.02(R470 for compatibility with K80 GPUs) |

Security Fixed CVE-2023-6915 in the Linux kernel.
Change Updated cos-gpu-installer to v2.1.10.

## January 31, 2024

Change

### cos-97-16919-450-6

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.208](https://cos.googlesource.com/third_party/kernel/+/92c7f8a63ca85a6a836dc8cfe4729f36bed7c838) | v20.10.24 | v1.6.21 | v470.223.02 (default),v535.154.05(latest),v470.223.02(R470 for compatibility with K80 GPUs) |

Announcement [This is an LTS Refresh release.](https://docs.cloud.google.com/container-optimized-os/docs/concepts/versioning#lts_refresh_releases)
Change Updated cos-gpu-installer to v2.1.10.
Security Fixed CVE-2024-22195 in dev-python/jinja.
Security Fixed CVE-2023-3164 in sys-apps/gawk.
Security Fixed CVE-2024-21626 in app-emulation/runc.
Change Updated latest NVIDIA GPU driver to 535.154.05.
Change Runtime sysctl changes:

- Added: net.ipv6.conf.all.accept_ra_min_lft: 0
- Added: net.ipv6.conf.default.accept_ra_min_lft: 0
- Added: net.ipv6.conf.docker0.accept_ra_min_lft: 0
- Added: net.ipv6.conf.eth0.accept_ra_min_lft: 0
- Added: net.ipv6.conf.lo.accept_ra_min_lft: 0
- Changed: fs.file-max: 813422 -\> 813419
- Changed: net.ipv6.route.max_size: 4096 -\> 2147483647

<br />

## January 16, 2024

Change

### cos-97-16919-404-34

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.197](https://cos.googlesource.com/third_party/kernel/+/88b950ffd1448f7ae3b547d7c5ac5f1fd60c2318) | v20.10.24 | v1.6.21 | v470.223.02 (default),v535.129.03(latest),v470.223.02(R470 for compatibility with K80 GPUs) |

Security Fixed CVE-2023-48795 in net-misc/openssh.
Security Upgraded dev-db/sqlite to v3.44.2-r2. This fixes CVE-2023-7104.

## January 08, 2024

Change

### cos-97-16919-404-33

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.197](https://cos.googlesource.com/third_party/kernel/+/88b950ffd1448f7ae3b547d7c5ac5f1fd60c2318) | v20.10.24 | v1.6.21 | v470.223.02 (default),v535.129.03(latest),v470.223.02(R470 for compatibility with K80 GPUs) |

Security Fixed CVE-2023-51385 in net-misc/openssh.
Security Upgraded sys-apps/dbus to v1.12.28. This fixes
CVE-2023-34969, CVE-2022-42012, CVE-2022-42011 and CVE-2022-42010.

## January 02, 2024

Change

### cos-97-16919-404-31

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.197](https://cos.googlesource.com/third_party/kernel/+/88b950ffd1448f7ae3b547d7c5ac5f1fd60c2318) | v20.10.24 | v1.6.21 | v470.223.02 (default),v535.129.03(latest),v470.223.02(R470 for compatibility with K80 GPUs) |

Security Fixed CVE-2023-6931 in the Linux kernel.
Fixed Updated docker-credential-gcr to v2.1.21.
Security Fixed CVE-2023-6932 in the Linux kernel.
Security Updated net-misc/curl to v8.5.0. This resolves CVE-2023-46218.

## December 19, 2023

Change

### cos-97-16919-404-26

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.197](https://cos.googlesource.com/third_party/kernel/+/5a5b1e7dac9b7b7090c71899d63aaacc35db2f7e) | v20.10.24 | v1.6.21 | v470.223.02 (default),v535.129.03(latest),v470.223.02(R470 for compatibility with K80 GPUs) |

Fixed Fixed a container performance issue that occurred after
running `systemctl start cloud-audit-setup`.

## December 04, 2023

Change

### cos-97-16919-404-21

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.197](https://cos.googlesource.com/third_party/kernel/+/fa17af896762e7797f9e05294e8b9a0e9dcf47c9) | v20.10.24 | v1.6.21 | v470.223.02 (default),v535.129.03(latest),v470.223.02(R470 for compatibility with K80 GPUs) |

Security Fixed CVE-2023-46862 in the Linux kernel.

## November 29, 2023

Change

### cos-97-16919-404-19

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.197](https://cos.googlesource.com/third_party/kernel/+/30e492ecce8decf0855b77d7e30c7f9ec9d23f8d) | v20.10.24 | v1.6.21 | v470.223.02 (default),v535.129.03(latest),v470.223.02(R470 for compatibility with K80 GPUs) |

Security Updated dev-libs/libxml2 to v2.11.5. This resolves CVE-2023-45322.
Feature Updated NVIDIA GPU drivers. This resolves CVE-2023-31022.

## November 15, 2023

Change

### cos-97-16919-404-17

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.197](https://cos.googlesource.com/third_party/kernel/+/30e492ecce8decf0855b77d7e30c7f9ec9d23f8d) | v20.10.24 | v1.6.21 | v470.199.02(default),v535.104.12(latest) |

Security Updated net-libs/nghttp2 to v1.57.0. This resolves CVE-2023-44487 and CVE-2023-35945.
Security Updated app-editors/vim,app-editors/vim-core to v9.0.2092.
This resolves CVE-2023-4733, CVE-2023-4734, CVE-2023-4735, CVE-2023-4736,
CVE-2023-4738, CVE-2023-4750, CVE-2023-4752, CVE-2023-4781,
CVE-2023-5344, CVE-2023-5441, CVE-2023-5535.
Security Fixed CVE-2023-46813 in the Linux kernel.

## November 14, 2023

Change

### cos-97-16919-404-17

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.197](https://cos.googlesource.com/third_party/kernel/+/30e492ecce8decf0855b77d7e30c7f9ec9d23f8d) | v20.10.24 | v1.6.21 | v470.199.02(default),v535.104.12(latest) |

Security Updated app-editors/vim,app-editors/vim-core to v9.0.2092.
This resolves CVE-2023-4733, CVE-2023-4734, CVE-2023-4735, CVE-2023-4736
CVE-2023-4738, CVE-2023-4750, CVE-2023-4752, CVE-2023-4781
CVE-2023-5344, CVE-2023-5441, CVE-2023-5535.
Security Updated net-libs/nghttp2 to v1.57.0. This resolves CVE-2023-44487 and CVE-2023-35945.
Security Fixed CVE-2023-46813 in the Linux kernel.

## November 07, 2023

Change

### cos-97-16919-404-13

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.197](https://cos.googlesource.com/third_party/kernel/+/1115a0046082d4caa07df61ed6b228e678be507f) | v20.10.24 | v1.6.21 | v470.199.02(default),v535.104.12(latest) |

Security Fixed CVE-2023-45863 in the Linux kernel.
Fixed Updated google-guest-configs to 20230929.00.
Security Fixed CVE-2023-42754 in the Linux kernel.
Security Fixed CVE-2023-5717 in the Linux kernel.

## October 30, 2023

Change

### cos-97-16919-404-9

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.197](https://cos.googlesource.com/third_party/kernel/+/3a2afcf2efc126fd92a1458e1fa9c70ab2146c04) | v20.10.24 | v1.6.21 | v470.199.02(default),v535.104.12(latest) |

Feature Enable portmapper registration reporting for lsof. This also fixes an issue where `lsof` is missing from SOS reports.
Fixed Updated latest NVIDIA GPU drivers to v535.104.12.

## October 24, 2023

Change

### cos-97-16919-404-4

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.197](https://cos.googlesource.com/third_party/kernel/+/3a2afcf2efc126fd92a1458e1fa9c70ab2146c04) | v20.10.24 | v1.6.21 | v470.199.02(default),v535.104.05(latest) |

Announcement [This is an LTS Refresh Release.](https://cloud.google.com/container-optimized-os/docs/concepts/versioning#lts_refresh_releases)
Change Runtime sysctl changes:

- Added: net.ipv4.tcp_migrate_req: 0
- Changed: fs.file-max: 813432 -\> 813422
- Changed: net.netfilter.nf_conntrack_sctp_timeout_shutdown_recd: 0 -\> 3
- Changed: net.netfilter.nf_conntrack_sctp_timeout_shutdown_sent: 0 -\> 3

<br />

Security Upgraded net-misc/curl to version 8.4.0. This resolves CVE-2023-38545.
Security Fix CVE-2023-42756 in COS kernel.

## October 16, 2023

Change

### cos-97-16919-353-53

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.186](https://cos.googlesource.com/third_party/kernel/+/f9ab03d5f281de5df86b7131930dc56bafb6f618) | v20.10.24 | v1.6.21 | v470.199.02(default),v535.104.05(latest) |

Security Fixed CVE-2023-42753 in the Linux Kernel.
Fixed Updated cos-gpu-installer to v2.1.9.
Security Fixed CVE-2023-38039 in net-misc/curl.

## October 11, 2023

Change

### cos-97-16919-353-53

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.186](https://cos.googlesource.com/third_party/kernel/+/f9ab03d5f281de5df86b7131930dc56bafb6f618) | v20.10.24 | v1.6.21 | v470.199.02(default),v535.104.05(latest) |

Security Fixed CVE-2023-38039 in net-misc/curl.
Security Fixed CVE-2023-42753 in the Linux Kernel.
Fixed Upgraded cos-gpu-installer to v2.1.9.

## September 26, 2023

Change

### cos-97-16919-353-50

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.186](https://cos.googlesource.com/third_party/kernel/+/46396331828f4d67391433b8282000d61d9e7b65) | v20.10.24 | v1.6.21 | v470.199.02(default),v535.104.05 |

Fixed Fixed an issue where IPv6 networking would fail under high CPU load.
Security Fixed CVE-2023-4623 in the Linux kernel.
Security Fixed CVE-2023-4921 in the Linux kernel.

## September 18, 2023

Change

### cos-97-16919-353-46

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.186](https://cos.googlesource.com/third_party/kernel/+/5fea7a4626b341554dc942d8cb54cb6bba40eda1) | v20.10.24 | v1.6.21 | v470.199.02(default),v535.104.05 |

Security Fixed CVE-2023-4622 in the linux kernel.

## September 11, 2023

Change

### cos-97-16919-353-44

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.186](https://cos.googlesource.com/third_party/kernel/+/0a9771f609e44dfec5656c2d2aa8bf722969fc82) | v20.10.24 | v1.6.21 | v470.199.02(default),v535.104.05 |

Change Updated cos-gpu-installer to v2.1.7. Switched precompiled
driver and signature location to COS build artifacts.
Security Fixed the following CVEs in sys-libs/binutils-libs: CVE-2022-47007
CVE-2022-47008, CVE-2022-47010, CVE-2022-47011, CVE-2022-48063, CVE-2022-48064,
CVE-2022-48065.
Fixed Changed error handling in get_metadata_value script
to retry if connection error happens during instance metadata check.
Change Updated latest GPU driver to v535.104.05.
Fixed Fixed problem with NFS reconnects when using DPv2 in
kube-proxy-free mode.

## September 07, 2023

Change

### cos-97-16919-353-31

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.186](https://cos.googlesource.com/third_party/kernel/+/4700e89209d124978ecc774137e84228bd645559) | v20.10.24 | v1.6.21 | v470.199.02(default),v525.125.06 |

Security Upgraded sys-process/procps to 3.3.17. This fixed CVE-2018-1121 and CVE-2023-4016.
Security Upgraded sys-fs/mdadm to v4.2. This resolves CVE-2023-28938 and CVE-2023-28736.
Security Fixed CVE-2023-4128 in the Linux kernel.
Fixed Enabled persistence mode with Nvidia GPU driver
installation.
Feature Enabled trusted IMA certificate loading from
/etc/ima/pubkey.x509.
Security Updated xz-utils to 5.2.9. This resolves CVE-2020-22916.
Change Runtime sysctl changes:

- Added: kernel.io_uring_disabled: 0

<br />

## August 21, 2023

Change

### cos-97-16919-353-23

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.186](https://cos.googlesource.com/third_party/kernel/+/49231d8134ee97739407a91c7176ab99dce48aff) | v20.10.24 | v1.6.21 | v470.199.02(default),v525.125.06 |

Security Fixed CVE-2023-4194 in the Linux kernel.
Security Fixed CVE-2023-4147 in the Linux kernel.
Security Upgrade app-misc/jq to v1.7_pre20201109-r1. This fixes CVE-2016-4074.
Change Simplified GPU driver installation by remounting the driver
installation path as executable from cos-extensions.
Security Updated dev-libs/openssl to v1.1.1v. This resolves CVE-2023-3817.

## August 14, 2023

Change

### cos-97-16919-353-15

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.186](https://cos.googlesource.com/third_party/kernel/+/53aa9ce4335d0a7354889375a6f539259b2caa28) | v20.10.24 | v1.6.21 | v470.199.02(default),v525.125.06 |

Security Fixed CVE-2023-32001 in net-misc/curl.
Security Fixed CVE-2023-38408 in net-misc/openssh.
Security Fixed CVE-2022-28737 in sys-boot/shim.
Security Fixed CVE-2023-4004, CVE-2023-3777, CVE-2023-3776, CVE-2023-1206 and CVE-2023-3611 in the Linux kernel.
Security Fixed CVE-2022-40896 in dev-python/pygments.

## July 25, 2023

Change

### cos-97-16919-353-4

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.186](https://cos.googlesource.com/third_party/kernel/+/7b67b454ac78efd591dc72fc6e4e4535a4ef1886) | v20.10.24 | v1.6.21 | v470.199.02(default),v525.125.06 |

Security Fixed CVE-2023-35001 in the Linux kernel.
Security Fixed CVE-2023-31248 in the Linux kernel.

## July 18, 2023

Announcement [This is an LTS Refresh Release.](https://cloud.google.com/container-optimized-os/docs/concepts/versioning#lts_refresh_releases)
Change

### cos-97-16919-353-1

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.186](https://cos.googlesource.com/third_party/kernel/+/03416fd4737671a686565c10c0a3b97044b6d64a) | v20.10.24 | v1.6.21 | v470.199.02 (default),v525.125.06 |

Change Updated app-emulation/docker and app-emulation/docker-cli to v20.10.24.
Change Updated app-admin/google-osconfig-agent to v20230222.00.
Security Fixed CVE-2023-3609 in the Linux kernel.
Security Updated default GPU driver to v470.199.02 and latest GPU driver to v525.125.06. This resolves CVE-2023-25515 and CVE-2023-25516.
Change Updated containerd to v1.6.21
Security Updated open-vm-tools to v12.2.5. This resolves CVE-2023-20867.
Change Runtime sysctl changes:

- Changed: net.core.bpf_jit_limit: 264241152 -\> 528482304

<br />

## July 13, 2023

Change

### cos-97-16919-294-51

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.176](https://cos.googlesource.com/third_party/kernel/+/c39b9f2a1c490c6cc9a8072daf042ac3c5f13977) | v20.10.14 | v1.6.20 | v470.182.03(default),v525.105.17 |

Security Fixed CVE-2023-31486 in perl.
Security Fixed CVE-2023-3090 in the Linux kernel.

## June 29, 2023

Change

### cos-97-16919-294-48

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.176](https://cos.googlesource.com/third_party/kernel/+/05c681778c35de2f2d841ee97d13d100fea84d3f) | v20.10.14 | v1.6.20 | v470.182.03(default),v525.105.17 |

Security Fixed CVE-2023-3268 in the Linux kernel.
Security Upgraded sys-apps/file to v5.43-r1 to fix CVE-2019-18218.

## June 26, 2023

Change

### cos-97-16919-294-44

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.176](https://cos.googlesource.com/third_party/kernel/+/50ca7e92415d778a409c893b6455a3c811b227cf) | v20.10.14 | v1.6.20 | v470.182.03(default),v525.105.17 |

Security Fix CVE-2023-1972 in binutils.
Fixed Updated toolbox to v20230615.
Security Fixed CVE-2023-34256 in the Linux kernel.
Change Updated google-guest-configs to v20230526.00.

## June 12, 2023

Change

### cos-97-16919-294-35

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.176](https://cos.googlesource.com/third_party/kernel/+/b1b40873b95a40789a541ebf0fc9b1ff42d90903) | v20.10.14 | v1.6.20 | v470.182.03(default),v525.105.17 |

Security Updated net-misc/curl to v8.1.0-r1. This resolves CVE-2023-28319, CVE-2023-28320, CVE-2023-28321, and CVE-2023-28322.
Security Fixed CVE-2022-4269 in the Linux kernel.
Security Fixed CVE-2023-2124 in the Linux kernel.
Security Updated dev-libs/openssl to v1.1.1u. This resolves CVE-2023-2650.

## June 05, 2023

Change

### cos-97-16919-294-28

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.176](https://cos.googlesource.com/third_party/kernel/+/ff43a13c9b5dccf909f917601240fd7f4372d195) | v20.10.14 | v1.6.20 | v470.182.03(default),v525.105.17 |

Security Updated ncurses to v6.4p20220423. This resolves CVE-2023-29491.

## May 30, 2023

Change

### cos-97-16919-294-27

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.176](https://cos.googlesource.com/third_party/kernel/+/ff43a13c9b5dccf909f917601240fd7f4372d195) | v20.10.14 | v1.6.20 | v470.182.03(default),v525.105.17 |

Security Fixed CVE-2023-28842 in docker.

## May 22, 2023

Change

### cos-97-16919-294-23

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.176](https://cos.googlesource.com/third_party/kernel/+/ff43a13c9b5dccf909f917601240fd7f4372d195) | v20.10.14 | v1.6.20 | v470.182.03(default), v525.105.17 |

Security Fixed CVE-2022-36109 in app-emulation/docker.
Security Updated app-editors/vim, app-editors/vim-core to v9.0.1562.
This resolves CVE-2023-2609, CVE-2023-2610, CVE-2023-2426.
Security Updated app-emulation/cloud-init to 23.1.2 which fixes CVE-2023-1786.

## May 09, 2023

Change

### cos-97-16919-294-15

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.176](https://cos.googlesource.com/third_party/kernel/+/ff43a13c9b5dccf909f917601240fd7f4372d195) | v20.10.14 | v1.6.20 | v470.182.03(default),v525.105.17 |

Security Updated dev-libs/libxml2 to v2.10.4. This resolves CVE-2023-28484.
Change Updated app-emulation/docker to v20.10.14. This resolves
CVE-2023-28840, CVE-2023-28841, CVE-2023-28842, CVE-2022-36109,
CVE-2022-27652.

## May 01, 2023

Change

### cos-97-16919-294-12

|---|---|---|---|
| Kernel | Docker | Containerd | GPU Drivers |
| [COS-5.10.176](https://cos.googlesource.com/third_party/kernel/+/ff43a13c9b5dccf909f917601240fd7f4372d195) | v20.10.12 | v1.6.20 | v470.182.03(default),v525.105.17 |

Security Upgraded net-misc/curl to v8.0.1. This resolves CVE-2023-27534.
Feature Fallback to installing compatible drivers when installer
is invoked for certain GPU devices and incompatible drivers.
Fixed Fixed an issue where chronyd does not restart after failure, resulting in the system time being out of sync.
Security Updated ncurses to v6.4p20220423. This resolves CVE-2023-29491.

## cos-97-16919-294-6

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Apr 17, 2023 | [COS-5.10.176](https://cos.googlesource.com/third_party/kernel/+/b400aabf2afd601096b57bef5c067e7bc36cb959) | v20.10.12 | v1.6.20 | v470.182.03(default),v525.105.17 |

Fixed
Fixed an issue where pstore is not cleaned
at boot time if COS metrics are disabled.
Security
Fixed CVE-2023-25809 in app-containers/runc.
Security
Fixed CVE-2023-0465, CVE-2023-0466 in dev-libs/openssl.

## cos-97-16919-294-3

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Apr 10, 2023 | [COS-5.10.176](https://cos.googlesource.com/third_party/kernel/+/b400aabf2afd601096b57bef5c067e7bc36cb959) | v20.10.12 | v1.6.20 | v470.182.03(default),v525.105.17 |

Security
Update default driver to 470.182.03. This resolves CVE
CVE-2023-0184, CVE-2023-0189, CVE-2023-0180, CVE-2023-0185,
CVE-2023-0187, CVE-2023-0198, CVE-2023-0199, CVE-2023-0188,
CVE-2023-0190, CVE-2023-0194, CVE-2023-0195, CVE-2023-0191.

<br />


Also update latest driver to 525.105.17. This resolves CVE-2023-0184, CVE-2023-0189, CVE-2023-0180, CVE-2023-0183, CVE-2023-0185, CVE-2023-0187,
CVE-2023-0198, CVE-2023-0199, CVE-2023-0188, CVE-2023-0190,
CVE-2023-0194, CVE-2023-0195, CVE-2023-0191.
Security
Fixed CVE-2023-0464 in dev-libs/openssl.

## cos-97-16919-294-1

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Apr 06, 2023 | [COS-5.10.176](https://cos.googlesource.com/third_party/kernel/+/b400aabf2afd601096b57bef5c067e7bc36cb959) | v20.10.12 | v1.6.20 | v470.161.03(default),v525.60.13 |

Announcement
[This is an LTS Refresh Release.](https://docs.cloud.google.com/container-optimized-os/docs/concepts/versioning#lts_refresh_releases)
Change
Updated google-guest-agent to v20230330.00.
Change
Updated containerd to v1.6.20.
Change
Updated the Linux kernel to v5.10.176.
Feature
Added support for L4 GPU in cos-gpu-installer and fixed cached
driver installation for prebuilt driver modules.
Feature
Enabled INET_DIAG_DESTROY kernel configuration.
Security
Fixed CVE-2022-4285 in binutils-libs.
Change
Runtime sysctl changes:

- Added: kernel.oops_limit: 10000
- Added: kernel.warn_limit: 0
- Changed: net.netfilter.nf_conntrack_sctp_timeout_established: 432000 -\> 210
- Deleted: net.netfilter.nf_conntrack_sctp_timeout_heartbeat_acked: 210

<br />

## cos-97-16919-235-48

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Apr 03, 2023 | [COS-5.10.162](https://cos.googlesource.com/third_party/kernel/+/8d4daec373891ff06bb60dd417f35b8ed79d00f4) | v20.10.12 | v1.6.18 | v470.161.03(default),v525.60.13 |

Security
Fixed CVE-2023-27561 in runc.

## cos-97-16919-235-46

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Mar 27, 2023 | [COS-5.10.162](https://cos.googlesource.com/third_party/kernel/+/8d4daec373891ff06bb60dd417f35b8ed79d00f4) | v20.10.12 | v1.6.18 | v470.161.03(default),v525.60.13 |

Fixed
Removed `CONFIG_NET_CLS_TCINDEX` kernel config entry.
Security
Fixed CVE-2023-28466 in the Linux kernel.

## cos-97-16919-235-36

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Mar 20, 2023 | [COS-5.10.162](https://cos.googlesource.com/third_party/kernel/+/acbd229d057d6cf06cd09bb6f911e930447205e0) | v20.10.12 | v1.6.18 | v470.161.03(default),v525.60.13 |

Security
Fixed CVE-2023-23931 in dev-python/cryptography.
Security
Updated app-editors/vim,app-editors/vim-core to v9.0.1403.
This resolves CVE-2022-4292, CVE-2022-4141, CVE-2023-0049, CVE-2023-0433, CVE-2023-0288, CVE-2023-0512, CVE-2023-1127, CVE-2023-1170, CVE-2023-0051, CVE-2023-0054, CVE-2023-1175, CVE-2023-1355 and CVE-2023-1264.

## cos-97-16919-235-31

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Mar 13, 2023 | [COS-5.10.162](https://cos.googlesource.com/third_party/kernel/+/acbd229d057d6cf06cd09bb6f911e930447205e0) | v20.10.12 | v1.6.18 | v470.161.03(default),v525.60.13 |

Fixed
Fixed a use-after-free issue in net/sched in the Linux kernel.

## cos-97-16919-235-30

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Mar 06, 2023 | [COS-5.10.162](https://cos.googlesource.com/third_party/kernel/+/3db1b2d6a249eff0e52d0964503af751941088d3) | v20.10.12 | v1.6.18 | v470.161.03(default),v525.60.13 |

Change
Updated app-emulation/containerd to v1.6.18. This resolves
CVE-2023-25173 and CVE-2023-25153.
Change
Update containerd to v1.6.15
Security
Update open-iscsi to 2.1.8 to fix CVE-2020-17437
Security
Updated dev-go/text to v0.3.8. This
fixes CVE-2022-32149.
Security
Fix CVE-2022-4285 in binutils and CVE-2022-4285 in binutils-libs
Security
Fixed CVE-2022-48303 in app-arch/tar
Security
Fixed CVE-2019-13636 in the sys-devel/patch package.
Security
Fixed CVE-2022-2928 and CVE-2022-2929 in net-misc/dhcp.
Security
Fixed CVE-2020-11080 in net-libs/nghttp2.
Security
Fixed CVE-2022-46663 in sys-apps/less and upgraded sys-apps/less to v608.
Security
Fixed CVE-2019-18276 in app-shells/bash.
Security
Update net-fs/cifs-utils to v6.15. Fixes CVE-2022-29869, CVE-2021-20208, and CVE-2022-27239 in net-fs/cifs-utils.
Security
Fixed CVE-2021-27291 and CVE-2021-20270 in dev-python/pygments.
Security
Added fix for CVE-2021-43618 in dev-libs/gmp.

## cos-97-16919-235-13

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Feb 14, 2023 | [COS-5.10.162](https://cos.googlesource.com/third_party/kernel/+/3db1b2d6a249eff0e52d0964503af751941088d3) | v20.10.12 | v1.6.9 | v470.161.03(default),v525.60.13 |

Change
Updated cos-gpu-installer to v2.0.31. This adds support for
gsp_tu10x.bin and gsp_ad10x.bin gsp firmware files and removes the
container dependency on python2.
Change
Upgraded Nvidia latest drivers from v510.108.03 to v525.60.13.
Security
Updated dev-libs/openssl to v1.1.1t. This resolves
CVE-2022-4450, CVE-2023-0215, CVE-2022-4304 and CVE-2023-0286.

## cos-97-16919-235-9

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Jan 31, 2023 | [COS-5.10.162](https://cos.googlesource.com/third_party/kernel/+/3db1b2d6a249eff0e52d0964503af751941088d3) | v20.10.12 | v1.6.9 | v470.161.03(default),v510.108.03 |

Security
Fixed CVE-2022-40897 in dev-python/setuptools.
Security
Fixed CVE-2022-47929 in the Linux kernel.
Security
Fixed CVE-2023-23454 in the Linux Kernel.

## cos-97-16919-235-5

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Jan 23, 2023 | [COS-5.10.162](https://cos.googlesource.com/third_party/kernel/+/0ee6c6430e12016e89461c35c3e24fe0e4b96b15) | v20.10.12 | v1.6.9 | v470.161.03(default),v510.108.03 |

Security
Fixed a use-after-free bug in TCP in the Linux kernel.
Security
Updated the Linux kernel to v5.10.162.

## cos-97-16919-235-1

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Jan 09, 2023 | [COS-5.10.161](https://cos.googlesource.com/third_party/kernel/+/bc9d46ee13b70c6196b9338edb39487d78204b5d) | v20.10.12 | v1.6.9 | v470.161.03(default),v510.108.03 |

Announcement
[This is an LTS Refresh Release.](https://docs.cloud.google.com/container-optimized-os/docs/concepts/versioning#lts_refresh_releases)
Change
Updated containerd to v1.6.9.
Change
Updated lvm2 to v2.03.14.
Change
Updated the Linux kernel to v5.10.161.
Fixed
Fixed no CNI info for pod sandbox on restart in app-emulation/containerd.
Change
Updated curl to v7.86.0.
Security
Updated Nvidia default drivers to v470.161.03 fixing CVE-2022-34670, CVE-2022-34674, CVE-2022-34675, CVE-2022-34677, CVE-2022-34679, CVE-2022-34680, CVE-2022-34682, CVE-2022-42254, CVE-2022-42255, CVE-2022-42256, CVE-2022-42257, CVE-2022-42258, CVE-2022-42259, CVE-2022-42260, CVE-2022-42261, CVE-2022-42262, CVE-2022-42263, CVE-2022-42264 and latest to v510.108.03 fixing CVE-2022-34670, CVE-2022-34674, CVE-2022-34675, CVE-2022-34677, CVE-2022-34679,CVE-2022-34680, CVE-2022-34682, CVE-2022-34684, CVE-2022-42254, CVE-2022-42255,CVE-2022-42256, CVE-2022-42257, CVE-2022-42258, CVE-2022-42259, CVE-2022-42260,CVE-2022-42261, CVE-2022-42262, CVE-2022-42263, CVE-2022-42264.
Security
Fixed CVE-2022-23471 in app-emulation/containerd.
Security
Fixed CVE-2022-35260 and CVE-2022-32221 in net-misc/curl.
Security
Updated lxml to v4.6.5. This fixes CVE-2021-43818.
Security
Fixed CVE-2022-42328, CVE-2022-42329 and CVE-2022-4696 in the Linux kernel.

## cos-97-16919-189-20

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Dec 12, 2022 | [COS-5.10.147](https://cos.googlesource.com/third_party/kernel/+/47d26d6f28a918de2df0119232c152b89d005d1e) | v20.10.12 | v1.6.6 | v470.141.03(default),v510.47.03 |

Security
Updated dev-libs/libxml2 to v2.10.3. This resolves CVE-2022-40304 and
CVE-2022-40303.
Security
Fixed CVE-2022-36227 in app-arch/libarchive package.
Security
Fixed CVE-2022-3169 in the Linux kernel.

## cos-97-16919-189-15

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Dec 05, 2022 | [COS-5.10.147](https://cos.googlesource.com/third_party/kernel/+/9aa62e46b47a2c1c7fd560f34b689449d9d98f2a) | v20.10.12 | v1.6.6 | v470.141.03(default),v510.47.03 |

Fixed
Set ManageForeignRoutes and ManageForeignRoutingPolicyRules to `no` in case `cos.disable_systemd_route_mgmt` is present in the kernel command line.
Security
Fixed CVE-2022-3821 in sys-apps/systemd.

## cos-97-16919-189-12

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Nov 10, 2022 | [COS-5.10.147](https://cos.googlesource.com/third_party/kernel/+/9aa62e46b47a2c1c7fd560f34b689449d9d98f2a) | v20.10.12 | v1.6.6 | v470.141.03(default),v510.47.03 |

Security
Updated cos-gpu-installer to v2.0.29. This addresses CVE-2022-3602 in
cos-gpu-installer.

## cos-97-16919-189-9

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Nov 07, 2022 | [COS-5.10.147](https://cos.googlesource.com/third_party/kernel/+/9aa62e46b47a2c1c7fd560f34b689449d9d98f2a) | v20.10.12 | v1.6.6 | v470.141.03(default),v510.47.03 |

Security
Updated app-editors/vim and app-editors/vim-core to v9.0.0828. This resolves
CVE-2022-3234, CVE-2022-3235, CVE-2022-3256, CVE-2022-3278, CVE-2022-3296,
CVE-2022-3297, CVE-2022-3324, CVE-2022-3352 and CVE-2022-3705.
Security
Fixed CVE-2022-42915 in curl.

## cos-97-16919-189-5

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Oct 31, 2022 | [COS-5.10.147](https://cos.googlesource.com/third_party/kernel/+/9aa62e46b47a2c1c7fd560f34b689449d9d98f2a) | v20.10.12 | v1.6.6 | v470.141.03(default),v510.47.03 |

Security
Fixed CVE-2021-46848 in libtasn1.
Security
Fixed CVE-2022-3524 in the Linux kernel.

## cos-97-16919-189-3

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Oct 24, 2022 | [COS-5.10.147](https://cos.googlesource.com/third_party/kernel/+/d45a5f95207952be35f6d99da9bf7e5b1c3c1d7a) | v20.10.12 | v1.6.6 | v470.141.03(default),v510.47.03 |

Security
Fixed CVE-2022-2602 in the Linux kernel.
Change
Runtime sysctl changes:

- Changed: fs.file-max: 813432 -\> 813431

<br />

## cos-97-16919-189-2

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Oct 17, 2022 | [COS-5.10.147](https://cos.googlesource.com/third_party/kernel/+/5ec33caa0200e8fc781961aca0abf57d1c706f15) | v20.10.12 | v1.6.6 | v470.141.03(default),v510.47.03 |

Announcement
[This is an LTS Refresh Release.](https://docs.cloud.google.com/container-optimized-os/docs/concepts/versioning#lts_refresh_releases)
Feature
Enabled `FANOTIFY_ACCESS_PERMISSIONS` configuration in kernel.
Change
Upgraded docker-credential-gcr to v2.1.5.
Change
Updated the built-in kubectl/kubelet to v1.23.10.
Change
Updated the Linux kernel to v5.10.147.
Change
Updated stackdriver logging agent to v1.9.8.
Change
Updated toolbox to v20220630.
Change
Do not configure VM when opting out of a particular CIS benchmark.
Fixed
Fixed an issue related to IP leakage in containerd.
Fixed
Fixed an issue where the image may fail to boot boot due to `mok out of
resources` error in the shim.
Security
Updated open-vm-tools package to v12.1.0. This resolves CVE-2022-31676.
Security
Updated net-misc/curl package to v7.85.0-r2. This resolves the following
CVEs: CVE-2022-35252,CVE-2022-22576,CVE-2022-27774,CVE-2022-27775,
CVE-2022-27776,CVE-2022-27778,CVE-2022-27779,CVE-2022-27780,CVE-2022-27781,
CVE-2022-27782,CVE-2022-30115.
Security
Fixed an out-of-bounds read in libarchive. This resolves CVE-2022-26280.
Security
Updated vim/vim-core to v9.0.0467. This resolves the following CVEs:
CVE-2022-3153,CVE-2022-3134,CVE-2022-3099,CVE-2022-3037,CVE-2022-3016,
CVE-2022-2980,CVE-2022-2946,CVE-2022-2923,CVE-2022-2889,CVE-2022-2874,
CVE-2022-2862,CVE-2022-2849,CVE-2022-2845,CVE-2022-2819,CVE-2022-2817,
CVE-2022-2816,CVE-2022-2598,CVE-2022-2581,CVE-2022-2580,CVE-2022-2571,
CVE-2022-2175,CVE-2022-2182,CVE-2022-2183,CVE-2022-2206,CVE-2022-2207,
CVE-2022-2208,CVE-2022-2210,CVE-2022-2231,CVE-2022-2257,CVE-2022-2264,
CVE-2022-2284,CVE-2022-2285,CVE-2022-2286,CVE-2022-2287,CVE-2022-2288,
CVE-2022-2289,CVE-2022-2304,CVE-2022-2343,CVE-2022-2344,CVE-2022-2345,
CVE-2022-2522,CVE-2022-2982.
Security
Fixed CVE-2022-41222 in the Linux Kernel.

## cos-97-16919-103-51

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Oct 06, 2022 | [COS-5.10.133](https://cos.googlesource.com/third_party/kernel/+/cb1d3f28467d33c1165181e8ddd2982311fd4687) | v20.10.12 | v1.6.6 | v470.141.03(default),v510.47.03 |

Security
Fixed CVE-2022-20409 in the Linux Kernel.

## cos-97-16919-103-49

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Sep 26, 2022 | [COS-5.10.133](https://cos.googlesource.com/third_party/kernel/+/9d103362a99760f3855d11b1f45743a88dae13c3) | v20.10.12 | v1.6.6 | v470.141.03(default),v510.47.03 |

Security
Fixed CVE-2022-2905 in the Linux kernel.

## cos-97-16919-103-48

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Sep 19, 2022 | [COS-5.10.133](https://cos.googlesource.com/third_party/kernel/+/815160aaef4a8c2faad58a46af3920545602dc88) | v20.10.12 | v1.6.6 | v470.141.03(default),v510.47.03 |

Change
Updated Google OS Config Agent(aka VMManager) to v20220801.00.
Fixed
Updated cos-gpu-installer to v2.0.27. This resolves the issue where multiple installers
can be started in the same VM.
Security
Updated app-arch/gzip to v1.12. This resolves CVE-2022-1271.
Security
Updated net-libs/gnutls to v3.7.7. This resolves CVE-2022-2509.
Security
Fixed CVE-2022-3028 and CVE-2022-39188 in the Linux kernel.

## cos-97-16919-103-42

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Sep 12, 2022 | [COS-5.10.133](https://cos.googlesource.com/third_party/kernel/+/3f5c5653366ca30cd064b4c037c05fa86475705a) | v20.10.12 | v1.6.6 | v470.141.03(default),v510.47.03 |

Change
Upgraded the GPU driver version in the "latest" track to v510.47.03.
Fixed
Updated cos-gpu-installer to v2.0.26. This resolves the
compatibility issue with K80 GPU devices. When an incompatible driver
version (R510+) is chosen in an instance with K80 GPU, the installer
will automatically fall back to an available R470 driver version.
Fixed
Fixed an issue causing zero verifier for FILE_SYNC and DATA_SYNC WRITEs.
Fixed
Fixed a scenario of high contention state of the system in
case filesystem is almost full and processes is trying to write content.
Fixed
Fixed memory leak in the seccomp subsystem.
Security
Upgraded libtirpc to v1.3.3 fixing CVE-2021-46828.
Security
Fixed CVE-2022-36946, CVE-2021-4037 in the Linux kernel.

## cos-97-16919-103-35

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Sep 06, 2022 | [COS-5.10.133](https://cos.googlesource.com/third_party/kernel/+/ae108ebd09de7481b592b82e5c4677ccc3558bb6) | v20.10.12 | v1.6.6 | v470.141.03(default) |

Fixed
Fixed kdump on NVME disks.
Security
Updated gnutls to v3.7.6. This resolves CVE-2021-4209.
Security
Fixed CVE-2021-3669 in the Linux kernel.

## cos-97-16919-103-33

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Aug 29, 2022 | [COS-5.10.133](https://cos.googlesource.com/third_party/kernel/+/3df8cc9b8aaf2009b9292a128ae580a914a162a9) | v20.10.12 | v1.6.6 | v470.141.03(default) |

Fixed
Fixed issues in cos-gpu-installer where nvidia-peermem.ko
was not installed and where driver signatures were included in the
cached build tools.
Security
Fixed CVE-2022-1158 in Linux Kernel.

## cos-97-16919-103-28

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Aug 22, 2022 | [COS-5.10.133](https://cos.googlesource.com/third_party/kernel/+/ef6e986e71ef8b8a4cabb8c8b5346577208435ff) | v20.10.12 | v1.6.6 | v470.141.03(default) |

Security
Updated net-misc/rsync to v3.2.5 and fixed
CVE-2022-29154.
Security
Updated dev-db/sqlite to v3.39.2 to fix CVE-2022-35737.

## cos-97-16919-103-25

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Aug 15, 2022 | [COS-5.10.133](https://cos.googlesource.com/third_party/kernel/+/ef6e986e71ef8b8a4cabb8c8b5346577208435ff) | v20.10.12 | v1.6.6 | v470.141.03(default) |

Fixed
Enable IOMMU_SUPPORT and IRQ_REMAP kernel configurations.

## cos-97-16919-103-22

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Aug 08, 2022 | [COS-5.10.133](https://cos.googlesource.com/third_party/kernel/+/826d7ea373b5d68fa6ca2f0f158137b8e7cb7d9d) | v20.10.12 | v1.6.6 | v470.141.03(default) |

Change
Updated default and latest Nvidia drivers to v470.141.03.
Security
Fixed CVE-2022-21505 in the Linux kernel.

## cos-97-16919-103-20

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Aug 01, 2022 | [COS-5.10.133](https://cos.googlesource.com/third_party/kernel/+/e4f3c14bf64041252ee1e65b3994c11ca60fb920) | v20.10.12 | v1.6.6 | v470.82.01(default) |

Fixed
Updated toolbox to v20220722.
Security
Updated the Linux kernel to v5.10.133. This includes
mitigations for the Retbleed speculative execution vulnerability. This
may have non-trivial performance impact on your workloads.

## cos-97-16919-103-16

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Jul 18, 2022 | [COS-5.10.123](https://cos.googlesource.com/third_party/kernel/+/6cdd454e81caa2f38222ca86cfa20061b7345e10) | v20.10.12 | v1.6.6 | v470.82.01(default) |

Security
Updated openssl to v1.1.1q. This resolves CVE-2022-2097.
Security
Updated net-misc/curl to v7.84.0. This resolves
CVE-2022-32205, CVE-2022-32206, CVE-2022-32207, CVE-2022-32208, CVE-2022-22576, CVE-2022-27774, CVE-2022-27775, CVE-2022-27776, CVE-2022-27778, CVE-2022-27779, CVE-2022-27780, CVE-2022-27781, CVE-2022-27782, and CVE-2022-30115.

## cos-97-16919-103-10

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Jul 11, 2022 | [COS-5.10.123](https://cos.googlesource.com/third_party/kernel/+/6150cfec353314bdc7a9d98a82963b469d9011ea) | v20.10.12 | v1.6.6 | v470.82.01(default) |

Change
Moved the toolchain source from gs://chromiumos-sdk to
gs://cos-sdk.
Security
Upgraded openssl to 1.1.1p to resolve CVE-2022-2068.
Security
Fixed CVE-2021-45346 in dev-db/sqlite.
Security
Updated app-editors/vim and app-editors/vim-core to
v8.2.5066. This resolves
CVE-2022-2126,CVE-2022-2125,CVE-2022-2124,CVE-2022-2129,CVE-2022-1720,
CVE-2022-1942,CVE-2022-1886,CVE-2022-1851,CVE-2022-1160,CVE-2022-1154,
CVE-2022-1381,CVE-2022-1420,CVE-2022-1733,CVE-2022-1796,CVE-2022-1769,
CVE-2022-1735,CVE-2022-1674,CVE-2022-1771,CVE-2022-1620,CVE-2022-1785,
CVE-2022-1629,CVE-2022-1616,CVE-2022-1621,CVE-2022-1619,CVE-2022-1927,
CVE-2022-1898
Security
Fixed a kernel crash issue originating in io_uring.

## cos-97-16919-103-4

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Jul 06, 2022 | [COS-5.10.123](https://cos.googlesource.com/third_party/kernel/+/4f6a3de226655381749533c408169ad767e5990e) | v20.10.12 | v1.6.6 | v470.82.01(default) |

Fixed
Fixed the bug in toolbox where long project name/container
image tag can fail to run the toolbox container.
Security
Fixed CVE-2022-29217 in dev-python/pyjwt.

## cos-97-16919-103-1

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Jun 29, 2022 | [COS-5.10.123](https://cos.googlesource.com/third_party/kernel/+/4f6a3de226655381749533c408169ad767e5990e) | v20.10.12 | v1.6.6 | v470.82.01(default) |

Announcement
[This is an LTS Refresh Release.](https://docs.cloud.google.com/container-optimized-os/docs/concepts/versioning#lts_refresh_releases)
Change
Updated cos-gpu-installer to fetch the COS toolchain from
gs://cos-tools instead of gs://chromiumos-sdk.
Change
Added `pci=clearmsi` option for kdump stackdriver.
Change
Updated the Linux Kernel to v5.10.123.
Fixed
Backported upstream patch to fix the issue
where systemd affects BFQ IO setup.
Security
Updated default toolbox container to v20220429.
Change
Runtime sysctl changes:

- Changed: kernel.random.poolsize: 4096 -\> 256
- Changed: kernel.random.write_wakeup_threshold: 896 -\> 256

<br />

## cos-97-16919-29-58

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Jun 27, 2022 | [COS-5.10.107](https://cos.googlesource.com/third_party/kernel/+/f773ec6a1f0a146718c68871adeae9707e0fee63) | v20.10.12 | v1.6.6 | v470.82.01(default) |

Security
Updated app-emulation/containerd to v1.6.6. This resolves
CVE-2022-31030.
Security
Updated app-emulation/runc to v1.1.2. This resolves CVE-2022-29162.
Fixed
Fixed a Linux kernel write IOPS regression with nfsd.
Security
Fixed CVE-2022-30594 and CVE-2022-1516 in the Linux Kernel.

## cos-97-16919-29-40

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Jun 03, 2022 | [COS-5.10.107](https://cos.googlesource.com/third_party/kernel/+/43faebd3c60e6a1b27a930604bb55d4ebaa1aee3) | v20.10.12 | v1.6.2 | v470.82.01(default) |

Fixed
Fixed the toolbox creation issue when service account is not
available.
Fixed
Fixed a bug in KTD LSM xattr handling.

## cos-97-16919-29-36

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| May 25, 2022 | [COS-5.10.107](https://cos.googlesource.com/third_party/kernel/+/2c8a11eaea8c25348b5d8c73279e19bab78f009d) | v20.10.12 | v1.6.2 | v470.82.01(default) |

Security
Fixed CVE-2022-1729 in the Linux Kernel.

## cos-97-16919-29-34

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| May 23, 2022 | [COS-5.10.107](https://cos.googlesource.com/third_party/kernel/+/e0e3bad14bf364dcc0d9a3f854dd489586a80beb) | v20.10.12 | v1.6.2 | v470.82.01(default) |

Fixed
Fixed an issue that prevented large cloud-configs (\~256KB)
from working properly.
Security
Upgraded openssl to v1.1.1o. This resolves CVE-2022-1292.
Security
Upgraded dev-libs/libxml2 to v2.9.14. This resolves CVE-2022-29824.
Security
Upgraded dev-libs/libxslt to v1.1.35. This resolves CVE-2022-29824.
Security
Upgraded sys-libs/ncurses to v6.3_p20220423. This resolves CVE-2022-29458.
Security
Fixed CVE-2022-1786, CVE-2022-28893 and CVE-2022-0494 in the Linux kernel.

## cos-97-16919-29-21

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Apr 25, 2022 | [COS-5.10.107](https://cos.googlesource.com/third_party/kernel/+/e2f67b8cc8ca37b1d9953baafa66f3d5044e1a7b) | v20.10.12 | v1.6.2 | v470.82.01(default) |

Fixed
Made /var/lib/chrony owned by chrony user.
Security
Fixed CVE-2022-29581 and CVE-2022-29582 in the Linux kernel.

## cos-97-16919-29-16

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Apr 18, 2022 | [COS-5.10.107](https://cos.googlesource.com/third_party/kernel/+/33f8efa193b4c1e0d6823b108db2740999032ca7) | v20.10.12 | v1.6.2 | v470.82.01(default) |

Change
Make CIS-Scanner show results for passing benchmarks.

## cos-97-16919-29-9

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Apr 11, 2022 | [COS-5.10.107](https://cos.googlesource.com/third_party/kernel/+/33f8efa193b4c1e0d6823b108db2740999032ca7) | v20.10.12 | v1.6.2 | v470.82.01(default) |

Security
Updated containerd to v1.6.2. This resolves CVE-2022-24769.
Security
Upgraded dev-libs/libxml2 to v2.9.13-r1. This resolves CVE-2022-23308.

## cos-97-16919-29-5

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Apr 05, 2022 | [COS-5.10.107](https://cos.googlesource.com/third_party/kernel/+/33f8efa193b4c1e0d6823b108db2740999032ca7) | v20.10.12 | v1.6.1 | v470.82.01(default) |

Fixed
Increased number of vCPUs support from 256 to 512.
Fixed
Fixed the issue where kubelet fails on startup by adding cgroup-driver=systemd flag to kubelet.

## cos-97-16919-29-2

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Mar 29, 2022 | [COS-5.10.107](https://cos.googlesource.com/third_party/kernel/+/dc1df9fab48bcc091abbe5f32ece016ddca8e5c6) | v20.10.12 | v1.6.1 | v470.82.01(default) |

Announcement
[This is an LTS Refresh release.](https://docs.cloud.google.com/container-optimized-os/docs/concepts/versioning#lts_refresh_releases)
Change
Updated app-admin/localtoast(cis_scanner) to v1.1.4.3.
Change
Updated the Linux kernel to v5.10.107.
Feature
Added an option to cos-extensions for populating and resetting a cache of
GPU driver dependencies.
Security
Updated app-editors/vim and app-editors/vim-core to v8.2.4586. This resolves
CVE-2022-0714, CVE-2022-0696, CVE-2022-0685, CVE-2022-0729, CVE-2022-0572
and CVE-2022-0629.

## cos-beta-97-16919-0-22

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Mar 25, 2022 | [COS-5.10.101](https://cos.googlesource.com/third_party/kernel/+/8575e4b55260587432cfa1d43975507f1bbefb8b) | v20.10.12 | v1.6.1 | v470.82.01(default) |

Security
Fixed CVE-2022-27666 in the Linux Kernel.
Security
Upgraded openssl package to v1.1.1n to fix CVE-2022-0778.

## cos-beta-97-16919-0-18

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | GPU Drivers |
| Mar 21, 2022 | [COS-5.10.101](https://cos.googlesource.com/third_party/kernel/+/57155a9caf493cffb50c5f864b7294b46822814a) | v20.10.12 | v1.6.1 | v470.82.01(default) |

Change
Updated google-guest-configs to v20220211.00.
Change
Updated CIS Scanner to v1.1.4.3.
Fixed
Fixed a warning related to IPv4 parsing error in cloud-init.
Security
Fixed CVE-2021-22570 in libprotobuf.

## cos-beta-97-16919-0-14

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | Default GPU Driver |
| Mar 16, 2022 | [COS-5.10.101](https://cos.googlesource.com/third_party/kernel/+/57155a9caf493cffb50c5f864b7294b46822814a) | v20.10.12 | v1.6.1 | v470.82.01 |

Feature
Added `get_status` API in device policy manager.
Fixed
Updated CIS Scanner to v1.1.4.2.
Fixed
Fixed an issue in systemd to consider primary network interface configured only after non-link-local IPv4 address is available.

## cos-beta-97-16919-0-8

|---|---|---|---|---|
| Date | Kernel | Docker | Containerd | Default GPU Driver |
| Mar 07, 2022 | [COS-5.10.101](https://cos.googlesource.com/third_party/kernel/+/57155a9caf493cffb50c5f864b7294b46822814a) | v20.10.12 | v1.6.1 | v470.82.01 |

Feature
Enabled disk_setup module in cloud-init.
Security
Fixed CVE-2022-0847 in the Linux kernel.
Security
Updated containerd to v1.6.1. This resolves CVE-2022-23648.

## cos-beta-97-16919-0-3 (vs Milestone 93)

|---|---|---|---|---|---|
| Date | Kernel | Kubernetes | Docker | Containerd | Default GPU Driver |
| Feb 28, 2022 | [COS-5.10.101](https://cos.googlesource.com/third_party/kernel/+/eaef059a5efafa36f701964cabb9f7542d2c20ea) | v1.23.3 | v20.10.12 | v1.6.0 | v470.82.01 |

Feature
Enabled cgroup v2 and provided command-line interface to change cgroup versions.
Feature
Added CIS scanner (app-admin/localtoast) v1.1.4.1.
Feature
Renamed cos-alphabet-compliance to cis-compliance. cis-compliance will only
install scripts needed to make the VM Level 2 CIS compliant.
Feature
Added the support to export logs of the cis-level1, cis-level2 and
cis-compliance-scanner systemd services via stackdriver logging.
Feature
Added command "cos-extensions list -- --gpu-installer" to show the default
cos-gpu-installer.
Feature
Enabled CONFIG_BFQ_GROUP_IOSCHED kernel configuration.
Feature
Set NVMe IO timeout to 4294967295
Feature
Fixed an issue in the Linux Kernel where I/Os would sometimes fail on
SEV-enabled machines due to a full swiotlb buffer.
Feature
Fixed an issue related to shim exiting during system shutdown.
Feature
Enabled XDP support in the Linux Kernel.
Feature
Add LZ4 compression support in kernel.
Feature
Enable ipip and fou kernel modules.
Feature
Made XFRM statistics available at /proc/net/xfrm_stat.
Feature
Added SEV live migration support to the Linux kernel.
Feature
Added dev-libs/userspace-rcu package.
Feature
[Auto-updates](https://cloud.google.com/container-optimized-os/docs/concepts/auto-update#automatic_update_design) will now only occur within a single milestone. Upgrading your VMs to a new COS milestone will now require you to recreate your VMs.
Feature
Added Google Guest Configs package.
Feature
Added lsof package.
Feature
Enabled virtual console.
Feature
Enabled configuring NTP server using cloud-init.
Feature
Added support for NFSv4 Kerberos authentication.
Feature
Enabled IBLOCK and FILEIO iSCSI backing stores in the Linux kernel.
Feature
Disabled VDSO on ARM by default.
Feature
Enabled ipv4 and ipv6 in sshd.
Change
Updated containerd to v1.6.0.
Change
Updated the Linux kernel to v5.10.101.
Change
Upgraded sys-fs/e2fsprogs to v1.46.4.
Change
Upgraded sys-libs/e2fsprogs-libs to v1.46.4.
Change
Upgraded sys-fs/xfsprogs to v5.14.2.
Change
Updated app-admin/sosreport to v4.2.
Change
Upgraded runc to v1.1.0.
Change
Updated the built-in kubectl/kubelet to v1.23.3.
Change
Updated oslogin to v20220113.00.
Change
Updated docker-cli to v20.10.12.
Change
Updated docker to v20.10.12.
Change
Updated Linux Audit (sys-process/audit) to v3.0.6.
Change
Updated sys-apps/shadow to v4.11.1.
Change
Upgraded Google OS Config Agent(aka VMManager) to v20220107.00.
Change
Updated UEFI shim to v15.4.
Change
Updated the makedumpfile package to v1.7.0.
Change
Updated the stackdriver logging agent to v1.9.4.
Change
Updated the default toolbox container to v20211027.
Change
Upgraded app-admin/google-guest-agent to v20220104.00.
Change
Updated cloud-init to v21.4.
Change
Updated systemd to v249.6.
Change
Updated docker-credential-gcr to v2.1.0.
Change
Updated ChromeOS base to ChromeOS version 14283.0.0.
Change
Upgraded net-dns/c-ares to v1.17.2.
Change
Updated node-problem-detector to v0.8.10.
Change
Updated nanopb to v0.4.5 in KTD.
Change
Runtime sysctl changes:

- Changed: net.ipv6.conf.all.forwarding: 1 -\> 0
- Changed: net.ipv6.conf.default.forwarding: 1 -\> 0
- Changed: net.ipv6.conf.docker0.forwarding: 1 -\> 0
- Changed: net.ipv6.conf.eth0.forwarding: 1 -\> 0
- Changed: net.ipv6.conf.lo.forwarding: 1 -\> 0
- Changed: kernel.bootloader_type: 114 -\> 6
- Changed: kernel.bootloader_version: 2 -\> 38
- Changed: kernel.core_pattern: \|/sbin/crash_reporter --user=%P:%s:%u:%g:%f -\> \|/bin/false
- Changed: kernel.core_pipe_limit: 4 -\> 0
- Changed: kernel.threads-max: 63623 -\> 63574
- Changed: net.ipv4.conf.all.log_martians: 0 -\> 1
- Changed: net.ipv4.conf.default.log_martians: 0 -\> 1
- Changed: net.ipv4.conf.docker0.log_martians: 0 -\> 1
- Changed: net.ipv4.conf.eth0.log_martians: 0 -\> 1
- Changed: user.max_cgroup_namespaces: 31811 -\> 31787
- Changed: user.max_ipc_namespaces: 31811 -\> 31787
- Changed: user.max_mnt_namespaces: 31811 -\> 31787
- Changed: user.max_net_namespaces: 31811 -\> 31787
- Changed: user.max_pid_namespaces: 31811 -\> 31787
- Changed: user.max_time_namespaces: 31811 -\> 31787
- Changed: user.max_user_namespaces: 31811 -\> 31787
- Changed: user.max_uts_namespaces: 31811 -\> 31787
- Added: dev.cdrom.autoclose: 1
- Added: dev.cdrom.autoeject: 0
- Added: dev.cdrom.check_media: 0
- Added: dev.cdrom.debug: 0
- Added: dev.cdrom.lock: 1
- Changed: fs.epoll.max_user_watches: 1667911 -\> 1667891
- Changed: fs.file-max: 814101 -\> 814087
- Changed: net.ipv4.tcp_mem: 94251 125668 188502 -\> 94248 125667 188496
- Changed: net.ipv4.udp_mem: 188502 251336 377004 -\> 188499 251335 376998

<br />

Fixed
Fixed segmentation fault in ebtables.
Fixed
Modified stackdriver logging default config to support multiple time formats
which fixed bug of dropped logs in some conditions.
Fixed
Updated toolbox script to use nspawn share system env var.
Fixed
update cri-tools to v1.23.0.
Fixed
Fixed a bug that created excessive warning logs on missing attrs.tag from
container logs.
Fixed
Updated cos-gpu-installer-v2 to v2.0.17 in cos-extensions.
Fixed
Changed default file permissions used by stackdriver logging agent to not be
world readable.
Security
Fixed CVE-2021-35942 and CVE-2021-38604 in glibc.