Container Optimized OS dev - Release notes

November 03, 2025

2025-11-03T00:00:00-08:00

Change

cos-dev-129-19350-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.12.55	v27.5.1	v2.1.3	See List

Change

Runtime sysctl changes:

Changed: fs.file-max: 811495 -> 811384

Feature

Fixed a bug in cos-extensions which would cause GB200 and GB300 devices not to be detected in one code path, which would result in Imex channels not being created by default.

Fixed

Fixed a TCPX bug which would sometimes incorrectly report devices as being missing when route cache entries were missing or invalidated.

Change

Updated the Linux kernel to v6.12.55.

October 27, 2025

2025-10-27T00:00:00-07:00

Change

cos-dev-129-19340-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.12.54	v27.5.1	v2.1.3	See List

Feature

Added GB300 support to cos-extensions.

Fixed

Added support for NVIDIA driver v535.274.02 and v570.195.03.

Change

Updated cos-gpu-installer to v2.5.9. This adds support for installing drivers for GB 300 devices.

Fixed

Upgraded sys-apps/less to v685.

Fixed

Upgraded sys-apps/pv to v1.9.44.

Change

Updated the Linux kernel to v6.12.54.

Security

Fixed CVE-2025-11413 and CVE-2025-11414 in binutils-libs.

Fixed

Upgraded chromeos-base/google-breakpad to v2025.10.16.221019-r255.

October 24, 2025

2025-10-24T00:00:00-07:00

Change

cos-dev-129-19334-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.12.53	v27.5.1	v2.1.3	See List

Security

Fixed CVE-2025-11495 in binutils-libs.

Change

Updated app-containers/runc to v1.2.7.

Security

Fixed CVE-2025-11494 in binutils-libs.

Fixed

Upgraded sys-auth/pambase to v20251013.

Fixed

Upgraded app-admin/google-guest-configs to v20251014.00.

Fixed

Upgraded sys-apps/pv to v1.9.42.

Change

Updated cos-gpu-installer to v2.5.8.

Security

Fixed CVE-2025-11412 in binutils-libs.

Feature

Added support for NVIDIA GB300 devices.

Fixed

Upgraded sys-apps/hwdata to v0.400.

Change

Added support for A4X-Max NICs.

October 20, 2025

2025-10-20T00:00:00-07:00

Change

cos-dev-129-19326-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.12.53	v27.5.1	v2.1.3	See List

Change

Runtime sysctl changes:

Changed: fs.file-max: 811438 -> 811426

Change

Updated the Linux kernel to v6.12.53.

Fixed

Updated the dump capture kernel to v6.12.52.

Security

Fixed KCTF-6bb73db in the Linux Kernel.

Fixed

Reduced gcr_wait_online retry gap.

Fixed

Updated golang.org/x/crypto, golang.org/x/net, and golang.org/x/oauth2 in kubelet and kubectl.

October 13, 2025

2025-10-13T00:00:00-07:00

Change

cos-dev-129-19319-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.12.50	v27.5.1	v2.1.3	See List

Change

Runtime sysctl changes:

Changed: fs.file-max: 811493 -> 811438
Changed: net.ipv4.udp_mem: 188034 250714 376068 -> 188034 250715 376068

Fixed

Upgraded sys-apps/hwdata to v0.399.

Feature

Added support for NVIDIA driver v580.95.05. Updated all latest driver version and default driver versions for NVIDIA_GB200 and NVIDIA_B200 to v580.95.05.

Change

Updated the Linux kernel to v6.12.50.

Fixed

Upgraded app-containers/docker-credential-helpers to v0.9.4.

Fixed

Upgraded net-libs/libtirpc to v1.3.7.

Security

Updated sys-apps/coreutils to v9.5. This resolves CVE-2024-0684.

Security

Fixed CVE-2025-11081, CVE-2025-11082 and CVE-2025-11083 in sys-libs/binutils-libs.

Fixed

Upgraded dev-libs/expat to v2.7.3.

Fixed

Updated toolbox container image tag to v20251002.

Fixed

Upgraded chromeos-base/google-breakpad to v2025.10.06.205107-r254.

Security

Updated dev-python/urllib3 to v2.5.0. This resolves CVE-2025-50181.

Security

Fixed KCTF-134121b in the Linux kernel.

Security

Upgraded open-vm-tools to 13.0.5. This fixes CVE-2025-41244 in anthos variant.

Fixed

Partially fixed an issue where excessive contention among writeback kworkers when switching a large number of inodes between cgroups could lead to system unresponsiveness.

October 06, 2025

2025-10-06T00:00:00-07:00

Change

cos-dev-129-19302-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.12.49	v27.5.1	v2.1.3	See List

Fixed

Add support for NVIDIA MFT Tools v4.33.0.

Change

Runtime sysctl changes:

Changed: fs.file-max: 811490 -> 811493
Changed: net.ipv4.udp_mem: 188034 250715 376068 -> 188034 250714 376068

Feature

Configured the cos-gpu-installer to use R580 drivers as the default GPU drivers.

Change

Updated the Linux kernel to v6.12.49.

Security

Updated dev-python/jinja to v3.1.6. This resolves CVE-2024-56326, CVE-2024-56201 and CVE-2025-27516.

September 29, 2025

2025-09-29T00:00:00-07:00

Change

cos-dev-129-19290-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.12.48	v27.5.1	v2.1.3	See List

Fixed

Updated golang.org/x/oauth2, golang.org/x/net, golang.org/x/crypto, and github.com/golang-jwt/jwt/v5 in Docker.

Feature

Added CPU balloon support for ARM CPUs.

Feature

Added support for the fwctl subsystem and the Mellanox fwctl driver for ARM64.

Fixed

Upgraded dev-libs/expat to v2.7.2.

Change

Updated the Linux kernel to v6.12.48.

Fixed

Upgraded app-admin/google-guest-configs to v20250913.00.

Fixed

Upgraded sys-auth/pambase to v20250906.

September 24, 2025

2025-09-24T00:00:00-07:00

Change

cos-dev-129-19284-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.12.47	v27.5.1	v2.1.3	See List

Fixed

Added support for NVIDIA driver v580.82.07. Updated all latest driver version and default driver versions for NVIDIA_GB200 and NVIDIA_B200 to v580.82.07.

Change

Updated the Linux kernel to v6.12.47.

Change

Enabled Coherent Driver Memory Management by default when installing GPU drivers on GB2000.

Change

Updated cos-gpu-installer to v2.5.7.

Fixed

Upgraded dev-libs/libxslt to version 1.1.43-r1.

Change

Runtime sysctl changes:

Changed: fs.file-max: 811423 -> 811483
Changed: net.ipv4.udp_mem: 188034 250715 376068 -> 188034 250714 376068

Security

Upgraded dev-libs/libxml2 to version 2.13.9. This fixes CVE-2025-9714, CVE-2025-32415 and CVE-2025-32414.

September 16, 2025

2025-09-16T00:00:00-07:00

Change

cos-dev-129-19279-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.12.46	v27.5.1	v2.1.3	See List

Fixed

Fixed a kernel bug which caused boot to fail for n4 machine types.

Feature

Added GDRCopy kernel module for NVIDIA drivers.

Change

Updated the Linux kernel to v6.12.46.

Feature

Added support for NVIDIA MFT Tools on arm64.

Change

Runtime sysctl changes:

Changed: fs.file-max: 811510 -> 811423

September 08, 2025

2025-09-08T00:00:00-07:00

Change

cos-dev-129-19271-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.12.43	v27.5.1	v2.1.3	See List

Feature

Enabled dynamic vlan configuration for non-primary NICs.

Change

Added kernel support for bare-metal on the NVIDIA Grace platform.

Fixed

Fixed an issue where cpusets cgroups did not work with cgroup v1 enabled.

Feature

Added iRDMA support in the Linux kernel.

Fixed

Upgraded sys-auth/pambase to v20250826.

Fixed

Upgraded sys-apps/file to v5.46-r3.

Security

Fixed CVE-2025-6052 in dev-libs/glib.

Change

Updated the Linux kernel to v6.12.43.

Fixed

Upgraded sys-apps/hwdata to v0.398.

Feature

Disabled DNSSEC by default for COS TPU VMs.

Fixed

Installed app-misc/c_rehash.

Feature

Added TDX RTMR support.

Change

Runtime sysctl changes:

Changed: fs.file-max: 811419 -> 811510

Fixed

Upgraded chromeos-base/google-breakpad to v2025.08.18.161925-r245.

Fixed

Upgraded app-admin/google-guest-configs to v20250818.00.

Feature

Added IPv6 support for machines using the IDPF driver.

Fixed

Upgraded app-admin/google-guest-configs to v20250826.00.

August 25, 2025

2025-08-25T00:00:00-07:00

Change

cos-dev-129-19251-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.12.42	v27.5.1	v2.1.3	See List

Fixed

Added support for the Lustre 2.14.0_p216 drivers.

Change

Runtime sysctl changes:

Changed: fs.file-max: 811494 -> 811419

Security

Fixed KCTF-abad3d0 in the Linux kernel.

August 18, 2025

2025-08-18T00:00:00-07:00

Change

cos-dev-129-19246-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.12.41	v27.5.1	v2.1.3	See List

Security

Upgraded sys-libs/binutils-libs to version 2.45. This fixes CVE-2025-8224,CVE-2025-8225 and CVE-2025-1153.

Fixed

Upgraded net-nds/rpcbind to v1.2.8.

Feature

Enabled the google-guest-agent's network management functionality.

Fixed

Upgraded sys-apps/gentoo-functions to v1.7.4.

Fixed

Upgraded dev-lang/go to v1.23.12.

Fixed

Upgraded chromeos-base/chromeos-common-script to v0.0.1-r668.

Security

Fixed KCTF-01d3c84 in the Linux kernel.

Fixed

Upgraded app-admin/google-guest-configs to v20250807.00.

Feature

Added ConnectX-8 RDMA support.

Feature

Backported support for AMD SEV-SNP SVSM vTPM driver and configfs-tsm addition for extended attestation protocol.

Fixed

Upgraded dev-db/sqlite to v3.50.4.

August 12, 2025

2025-08-12T00:00:00-07:00

Change

cos-dev-129-19226-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.12.41	v27.5.1	v2.1.3	See List

Security

Upgraded urllib3 to version 1.26.18. This fixes CVE-2021-33503, CVE-2023-43804, and CVE-2023-45803.

Security

Fixed CVE-2025-8058 in glibc.

Security

Added support for Nvidia driver version 535.261.03. This fixes CVE-2025-23286 and CVE-2025-23279.

Change

Runtime sysctl changes:

Changed: fs.file-max: 811510 -> 811531

Fixed

Removed an artifact registry ping that would delay multi-user.target indefinitely for machines with no external IP address.

Fixed

Upgraded dev-libs/openssl to 3.5.1.

Fixed

Upgraded chromeos-base/google-breakpad to v2025.07.23.214511-r244.

Fixed

Upgraded net-misc/openssh to 10.0_p1.

Fixed

Upgraded app-admin/sudo to v1.9.17_p2.

Fixed

Updated dev-python/requests to v2.32.4.

Security

Upgraded net-misc/netplan to 1.1.2. This fixes CVE-2022-4968.

Fixed

Updated app-admin/node-problem-detector to 0.8.21.

Security

Added support for Nvidia driver version 570.172.08. This fixes CVE-2025-23279.

Fixed

Upgraded dev-lang/go to v1.23.11.

Fixed

Upgraded app-admin/google-guest-configs to v20250718.00.

Fixed

Upgraded sys-apps/pv to v1.9.34.

Fixed

Fixed an issue where the cpuidle driver selected for some machine types would cause inflated reports of high CPU usage.

Fixed

Upgraded dev-db/sqlite to v3.50.3.

Security

Upgraded dev-libs/glib to 2.82.5. This resolves CVE-2024-52533.

Change

Updated containerd to v2.1.3.

Fixed

Updated app-containers/cni-plugins to 1.7.1.

Security

Upgraded dev-vcs/git to version 2.49.1. This fixes CVE-2025-48385, CVE-2025-27613, CVE-2025-27614, CVE-2025-48384, CVE-2025-46835.

Fixed

Upgraded virtual/logger to v0-r2.

Feature

Enabled hardware optimized SHA256 algorithms for x86 machines with SSSE3 and AVX/AVX2 instructions and ARM64 machines with SHA-NI and ARMv8 Crypto Extensions.

Feature

Enabled the Btrfs kernel module.

Fixed

Reverted a containerd change which reduced the default soft file descriptor limit for processes in containers to 1024.

Fixed

Upgraded chromeos-base/minijail to v18-r168.

Fixed

Upgraded sys-process/lsof to v4.99.5.

Feature

Removed the cloud-final.service dependency on multi-user.target which could delay cloud-init user-data scripts indefinitely when long-running startup scripts are used.

Feature

Added NVIDIA GPU driver's R580 branch. Updated the LATEST GPU driver label to version 580.65.06.

Fixed

Upgraded chromeos-base/shill-client to v0.0.1-r4879.

July 30, 2025

2025-07-30T00:00:00-07:00

Change

cos-dev-125-19175-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.12.37	v27.5.1	v2.0.4	See List

Security

Upgraded sqlite to v3.50.2. This resolves CVE-2025-6965.

Fixed

The NFS access cache is no longer cleared on login by default. To use the old behavior, load the NFS module with the nfs_fasc=1 module parameter.

Change

Runtime sysctl changes:

Changed: fs.file-max: 811539 -> 811510

Fixed

Updated app-misc/jq to v1.8.1.

Security

Fixed CVE-2024-26130 in dev-python/cryptography.

Security

Patched openssl to fix CVE-2023-50782 affecting dev-python/crytography.

Security

Fixed KCTF-5e28d5a in the Linux kernel.

July 24, 2025

2025-07-24T00:00:00-07:00

Change

cos-dev-125-19165-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.12.37	v27.5.1	v2.0.4	See List

Fixed

Upgraded uhaul to version 6.12-0.

Change

Updated the NVIDIA GPU driver policy for New Feature Branch (NFB) drivers. The LATEST tag has been updated to point to the stable 570.133.20 Production Branch. The 575.57.08 NFB driver remains available for development and testing but must now be selected by its specific version number.Removed 575.57.08 NFB driver support for NVIDIA_GB200 machine.

Security

Updated app-editors/nano to v8.5. This resolves CVE-2024-5742.

Security

Upgraded vim, vim-core to version 9.1.1500. This fixes CVE-2025-26603, CVE-2025-27423, CVE-2025-29768, CVE-2025-1215, CVE-2025-24014, CVE-2025-22134.

Feature

Remove support for the v2.14.0_p184 and v2.14.0_p198 Lustre client drivers.

Fixed

Upgraded app-admin/google-guest-configs to v20250627.00.

Feature

Added ARM support for the Lustre 2.14.0 drivers.

Fixed

Fixed an issue where some workloads could cause a full system hang when running close to their memory limit.

Change

Updated the Linux kernel to v6.12.37.

Change

Upgraded nvidia-container-toolkit to v1.17.8. This fixes CVE-2025-23266.

Fixed

Upgraded chromeos-base/shill-client to v0.0.1-r4875.

Security

Fixed CVE-2024-6174 and CVE-2024-11584 in cloud-init.

Fixed

Upgraded chromeos-base/google-breakpad to v2025.07.01.161305-r243.

Change

Runtime sysctl changes:

Added: kernel.apparmor_restrict_unprivileged_unconfined: 0
Added: kernel.core_file_note_size_limit: 4194304
Added: kernel.core_sort_vma: 0
Added: net.ipv4.fib_multipath_hash_seed: 0
Added: net.ipv4.tcp_pingpong_thresh: 1
Added: net.ipv6.conf.all.ra_honor_pio_life: 0
Added: net.ipv6.conf.all.ra_honor_pio_pflag: 0
Added: net.ipv6.conf.all.regen_min_advance: 2
Added: net.ipv6.conf.default.ra_honor_pio_life: 0
Added: net.ipv6.conf.default.ra_honor_pio_pflag: 0
Added: net.ipv6.conf.default.regen_min_advance: 2
Added: net.ipv6.conf.docker0.ra_honor_pio_life: 0
Added: net.ipv6.conf.docker0.ra_honor_pio_pflag: 0
Added: net.ipv6.conf.docker0.regen_min_advance: 2
Added: net.ipv6.conf.eth0.ra_honor_pio_life: 0
Added: net.ipv6.conf.eth0.ra_honor_pio_pflag: 0
Added: net.ipv6.conf.eth0.regen_min_advance: 2
Added: net.ipv6.conf.lo.ra_honor_pio_life: 0
Added: net.ipv6.conf.lo.ra_honor_pio_pflag: 0
Added: net.ipv6.conf.lo.regen_min_advance: 2
Added: vm.enable_soft_offline: 1
Changed: fs.epoll.max_user_watches: 1809007 -> 1808517
Changed: fs.fanotify.max_user_marks: 67544 -> 68412
Changed: fs.file-max: 811755 -> 811539
Changed: fs.inotify.max_user_watches: 63425 -> 64189
Changed: kernel.threads-max: 63487 -> 63178
Changed: net.ipv4.tcp_mem: 94041 125391 188082 -> 94017 125357 188034
Changed: net.ipv4.udp_mem: 188085 250783 376170 -> 188034 250715 376068
Changed: user.max_cgroup_namespaces: 31743 -> 31589
Changed: user.max_fanotify_marks: 67544 -> 68412
Changed: user.max_inotify_watches: 63425 -> 64189
Changed: user.max_ipc_namespaces: 31743 -> 31589
Changed: user.max_mnt_namespaces: 31743 -> 31589
Changed: user.max_net_namespaces: 31743 -> 31589
Changed: user.max_pid_namespaces: 31743 -> 31589
Changed: user.max_time_namespaces: 31743 -> 31589
Changed: user.max_user_namespaces: 31743 -> 31589
Changed: user.max_uts_namespaces: 31743 -> 31589
Changed: vm.lowmem_reserve_ratio: 256 256 32 0 0 -> 256 256 32 0
Deleted: kernel.sched_child_runs_first: 0

Change

Updated cos-gpu-installer to v2.5.5.

Fixed

Upgraded sysram to version 6.12-0.

Security

Upgraded app-admin/sudo to v1.9.17_p1. This resolves CVE-2025-32462 and CVE-2025-32463.

June 30, 2025

2025-06-30T00:00:00-07:00

Change

cos-dev-125-19126-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.6.94	v27.5.1	v2.0.4	See List

Fixed

Upgraded chromeos-base/google-breakpad to v2025.06.12.121629-r242.

Security

Upgrade libarchive to version 3.8.1. This fixes CVE-2025-5914.

Fixed

Upgraded chromeos-base/chromeos-common-script to v0.0.1-r667.

Fixed

Upgraded chromeos-base/shill-client to v0.0.1-r4871.

Change

Updated nvidia-container-toolkit to v1.17.7.

Fixed

Upgraded sys-apps/less to v679.

Fixed

Upgraded chromeos-base/shill-client to v0.0.1-r4872.

Fixed

Upgraded dev-db/sqlite to v3.50.1.

Change

Upgraded sys-apps/ethtool to version 6.11.

Fixed

Upgraded sys-process/procps to v4.0.5-r2.

Fixed

Upgraded dev-lang/go to v1.23.10.

Change

Runtime sysctl changes:

Changed: fs.file-max: 811773 -> 811755

Fixed

Added support for the Lustre 2.14.0_p212 drivers.

Fixed

Upgraded app-admin/google-guest-configs to v20250605.00.

Fixed

Upgraded sys-libs/libcap to v2.76.

Fixed

drop marvell-pcie-ep-octeon driver

Fixed

Upgraded app-admin/sudo to v1.9.17.

June 23, 2025

2025-06-23T00:00:00-07:00

Change

cos-125-19115-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.6.94	v27.5.1	v2.0.4	See List

Feature

Added NVIDIA 570.133.20 vGPU driver.

Change

Updated the Linux kernel to v6.6.94.

Change

Runtime sysctl changes:

Changed: fs.file-max: 811736 -> 811773

Security

Upgraded elfutils to version 0.193. This fixes CVE-2025-1365, CVE-2025-1371, CVE-2025-1372, and CVE-2025-1377.

Feature

Added a kernel patch to address bcache latency.

June 18, 2025

2025-06-18T00:00:00-07:00

Change

cos-dev-125-19104-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.6.93	v27.5.1	v2.0.4	See List

Security

Upgraded app-misc/jq to v1.8.0. This fixes CVE-2025-48060.

Change

Upgraded dpdk-kmods to 9b182be2ee4b

Change

Runtime sysctl changes:

Changed: fs.file-max: 811779 -> 811736

Change

Updated the Linux kernel to v6.6.93.

June 17, 2025

2025-06-17T00:00:00-07:00

Change

cos-dev-125-19094-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.6.92	v27.5.1	v2.0.4	See List

Change

Updated cos-gpu-installer to v2.5.3.

Change

Runtime sysctl changes:

Changed: fs.file-max: 811798 -> 811779

Security

Fixed KCTF-ac9fe7d in the kernel.

Feature

Added support for Nvidia driver version 575.57.08.

Fixed

Upgraded chromeos-base/shill-client to v0.0.1-r4869.

Security

Updated systemd to v254.26. This resolves CVE-2025-4598.

Change

Added support for the Lustre 2.14.0_p198 drivers.

Fixed

Upgraded dev-db/sqlite to v3.50.0.

Security

Fixed CVE-2025-47273 in dev-python/setuptools.

June 02, 2025

2025-06-02T00:00:00-07:00

Change

cos-dev-125-19071-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.6.92	v27.5.1	v2.0.4	See List

Security

Fixed KCTF-3f98113 in the Linux kernel.

Fixed

Upgraded app-admin/google-guest-configs to v20250516.00.

Fixed

Upgraded sys-apps/less to v678.

Fixed

Upgraded sys-apps/rootdev to v0.0.1-r51.

Fixed

Upgraded sys-apps/dbus to v1.16.2-r197.

Fixed

Upgraded chromeos-base/power_manager-client to v0.0.1-r2969.

Fixed

Upgraded dev-lang/go to v1.23.9.

Fixed

Upgraded chromeos-base/google-breakpad to v2025.05.22.184901-r240.

Change

Updated the Linux kernel to v6.6.92.

Change

Runtime sysctl changes:

Changed: fs.file-max: 811729 -> 811798
Changed: net.ipv6.conf.docker0.mtu: 1500 -> 1460

Security

Fixed CVE-2025-46836 in sys-apps/net-tools

Feature

Injected IMEX channel char device for GB200 GPUs.

Fixed

Updated cos-gpu-installer to v2.5.2: Added support for OTHER/NO_GPU cases to enable GPU driver preloading on the ARM64 architecture and added support for IMEX Driver configuration installation for NVIDIA_GB200 machine.

Security

Upgraded net-misc/curl to version 8.12.1. This fixes CVE-2025-0167.

Security

Fixed CVE-2024-23337 in app-misc/jq.

Fixed

Upgraded chromeos-base/debugd-client to v0.0.1-r2734.

Fixed

Fixed docker MTU mismatch.

Feature

Supported NVIDIA MFT Tools.

Fixed

Upgraded chromeos-base/chromeos-common-script to v0.0.1-r665.

Security

Fixed CVE-20250-3198 in sys-libs/bintuils-libs.

Fixed

Upgraded chromeos-base/shill-client to v0.0.1-r4866.

Change

Upgraded google-guest-agent to 20250327.00. This included new services like google-guest-compat-manager.service and google-guest-agent-manager.service and new binaries like google_guest_compat_manager, gce_metadata_script_runner, google_guest_agent_manager, ggactl_plugin_cleanup and gce_compat_metadata_script_runner.

Fixed

Upgraded chromeos-base/session_manager-client to v0.0.1-r2830.

Fixed

Upgraded dev-db/sqlite to v3.49.2.

May 12, 2025

2025-05-12T00:00:00-07:00

Change

cos-dev-125-19041-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.6.89	v27.5.1	v2.0.4	See List

Change

Updated the Linux kernel to v6.6.89.

Fixed

Fixed issue where modinfo could not display module signatures.

Change

Added support for 7th generation TPU devices.

Change

Runtime sysctl changes:

Changed: fs.file-max: 811773 -> 811729

Security

Updated apparmor to 3.1.6. This fixes CVE-2016-1585.

Change

Upgraded app-admin/google-guest-configs to v20250501.00.

Fixed

Increased kdump memory reservation.

May 05, 2025

2025-05-05T00:00:00-07:00

Change

cos-dev-125-19025-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.6.88	v27.5.1	v2.0.4	See List

Fixed

Upgraded sys-apps/makedumpfile to v1.7.7.

Fixed

Upgraded app-arch/gzip to v1.14.

Fixed

Upgraded chromeos-base/shill-client to v0.0.1-r4853.

Fixed

Upgraded chromeos-base/debugd-client to v0.0.1-r2733.

Fixed

Upgraded chromeos-base/minijail to v18-r167.

Fixed

Upgraded net-dns/libidn2 to v2.3.8.

Fixed

Upgraded chromeos-base/update_engine-client to v0.0.1-r2480.

Fixed

Upgraded chromeos-base/session_manager-client to v0.0.1-r2829.

Fixed

Upgraded chromeos-base/power_manager-client to v0.0.1-r2968.

Fixed

Upgraded chromeos-base/chromeos-common-script to v0.0.1-r664.

Security

Updated NVIDIA GPU drivers to v535.247.01 for default/ R535 and v570.133.20 for latest/R570. This resolves CVE-2025-23244.

Fixed

Upgraded chromeos-base/google-breakpad to v2025.04.09.155244-r236.

Change

Updated the Linux kernel to v6.6.88.

Fixed

Upgraded app-benchmarks/microbenchmarks to v0.0.1-r20.

Security

Fixed CVE-2025-32414, CVE-2025-32415 in dev-libs/libxml2.

Fixed

Upgraded app-admin/google-guest-agent to v20250418.00.

Fixed

Upgraded sys-apps/grep to v3.12.

Fixed

Upgraded app-admin/google-guest-configs to v20250409.00.

Change

Runtime sysctl changes:

Changed: fs.file-max: 811785 -> 811773

April 29, 2025

2025-04-29T00:00:00-07:00

Change

cos-dev-125-19014-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.6.87	v27.5.1	v2.0.4	See List

Feature

Fixed an issue in containerd that potentially breaks metric collection

Security

Fixed CVE-2025-31498 in net-dns/c-ares.

Change

Patched a null ptr exception bug in NVIDIA 570.124.06 OSS driver

Security

Fixed CVE-2025-32728 in net-misc/openssh.

Security

Updated dev-go/net in policy manager to v0.39.0. This fixes CVE-2025-22870.

Change

Runtime sysctl changes:

Changed: fs.file-max: 811798 -> 811785

Feature

Fixed an issue in containerd that prevented some v2 shims from shutting down properly.

April 25, 2025

2025-04-25T00:00:00-07:00

Change

cos-dev-125-19000-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.6.87	v27.5.1	v2.0.4	See List

Fixed

Upgraded app-admin/google-guest-agent to v20250408.00.

Change

Updated cos-gpu-installer to v2.5.0: Support IMEX Driver installation for NVIDIA_GB200 GPU device.

Change

Runtime sysctl changes:

Changed: fs.file-max: 811798 -> 811749

Fixed

Upgraded chromeos-base/shill-client to v0.0.1-r4850.

Security

Fixed CVE-2024-48615 in app-arch/libarchive.

Security

Fixed CVE-2024-53427 in app-misc/jq.

Change

Updated the Linux kernel to v6.6.87.

Fixed

Upgraded chromeos-base/chromeos-common-script to v0.0.1-r663.

Fixed

Upgraded chromeos-base/debugd-client to v0.0.1-r2732.

Fixed

Upgraded chromeos-base/session_manager-client to v0.0.1-r2828.

Security

Updated dev-vcs/git to version 2.49.0. This fixed CVE-2024-52006, CVE-2024-50349

Fixed

Upgraded chromeos-base/power_manager-client to v0.0.1-r2967.

Fixed

Reverted a change in the linux kernel which caused nfs directories to unexpectedly be mounted as ro instead of rw.

Fixed

Upgraded chromeos-base/update_engine-client to v0.0.1-r2479.

April 14, 2025

2025-04-14T00:00:00-07:00

Change

cos-dev-125-18986-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.6.86	v27.5.1	v2.0.4	See List

Fixed

Upgraded chromeos-base/power_manager-client to v0.0.1-r2966.

Fixed

Upgraded chromeos-base/minijail to v18-r164.

Fixed

Fixed EINTR error in app-container/cni-plugins.

Fixed

Upgraded chromeos-base/google-breakpad to v2025.04.01.213855-r235.

Fixed

Upgraded app-admin/google-guest-configs to v20250328.00.

Fixed

Upgraded dev-libs/expat to v2.7.1.

Fixed

Upgraded sys-apps/dbus to v1.14.10-r196.

Change

Updated the Linux kernel to v6.6.86.

Change

Runtime sysctl changes:

Changed: fs.file-max: 811816 -> 811798

Fixed

Upgraded chromeos-base/session_manager-client to v0.0.1-r2827.

Fixed

Upgraded chromeos-base/debugd-client to v0.0.1-r2731.

Fixed

Upgraded chromeos-base/update_engine-client to v0.0.1-r2478.

Fixed

Upgraded net-misc/rsync to v3.4.1.

Fixed

Upgraded app-arch/unzip to v6.0_p29.

Fixed

Modified toolbox to use unified cgroup hierarchy mode, when possible, instead of hybrid mode.

Fixed

Upgraded sys-apps/diffutils to v3.11-r2.

Fixed

Upgraded chromeos-base/chromeos-common-script to v0.0.1-r662.

Fixed

Upgraded net-nds/rpcbind to v1.2.7.

Fixed

Upgraded dev-libs/nss to v3.110.

Fixed

Upgraded chromeos-base/shill-client to v0.0.1-r4848.

Fixed

Upgraded app-containers/docker-credential-helpers to v0.9.3.

Fixed

Upgraded app-admin/google-guest-agent to v20250331.00.

Change

Updated app-containers/containerd to v2.0.4.

Fixed

Upgraded sys-libs/libseccomp to v2.6.0-r2.

March 31, 2025

2025-03-31T00:00:00-07:00

Change

cos-dev-125-18971-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.6.84	v27.5.1	v2.0.2	See List

Change

Updated the Linux kernel to v6.6.84.

Change

Runtime sysctl changes:

Changed: fs.file-max: 811727 -> 811816

March 24, 2025

2025-03-24T00:00:00-07:00

Change

cos-dev-125-18964-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.6.83	v27.5.1	v2.0.2	See List

Change

Updated app-admin/google-guest-configs to v20250207.00.

Fixed

Upgraded sys-apps/dbus to v1.14.10-r195.

Fixed

Upgraded app-admin/google-guest-agent to v20250304.03.

Fixed

Upgraded chromeos-base/minijail to v18-r163.

Fixed

Upgraded sys-apps/pv to v1.9.27.

Fixed

Upgraded chromeos-base/debugd-client to v0.0.1-r2727.

Security

Upgraded net-misc/wget to version 1.25.0. Fixes CVE-2024-10524.

Fixed

Upgraded sys-libs/libseccomp to v2.6.0.

Feature

Support for NVIDIA B200 GPU – Added support for the R570 driver series, including version 570.86.15. This version has been assigned the latest, default, and R570 tags.

Fixed

Upgraded net-misc/socat to v1.8.0.3.

Fixed

Upgraded chromeos-base/session_manager-client to v0.0.1-r2817.

Fixed

Upgraded chromeos-base/shill-client to v0.0.1-r4838.

Feature

Applied Intel patches to add iRDMA support in the Linux kernel.

Fixed

Updated dev-python/botocore to v1.37.9.

Fixed

Upgraded dev-libs/nss to v3.109.

Change

Updated Python to v3.11.

Fixed

Upgraded sys-auth/pambase to v20250228.

Fixed

Upgraded app-admin/fluent-bit to v3.2.5.

Fixed

Updated app-admin/awscli to v1.38.4.

Feature

Added support for NVIDIA GB200 GPU with 570.124.06 GPU driver. This driver version has been assigned the latest, default, and R570 tags for this GPU type.

Fixed

Upgraded app-admin/google-guest-agent to v20250122.00.

Security

Updated dev-go/oauth2 to v0.27.0. Fixes CVE-2025-22868.

Change

Upgraded app-containers/docker to v27.5.1, Upgraded app-containers/docker-test to v27.5.1, Upgraded app-containers/docker-cli to v27.5.1.

Fixed

Upgraded dev-db/sqlite to v3.49.1.

Fixed

Upgraded chromeos-base/shill-client to v0.0.1-r4834.

Security

Upgraded dev-go/crypto to v0.35.0. This fixes CVE-2025-22869.

Feature

Updated cos-gpu-installer to v2.4.7: 1.Added Support for NVIDIA B200 GPU. 2.Enabled --prepare-build-tools flag to preload GPU driver metadata for ARM64

Security

Upgraded dev-libs/libxml2 to version 1.12.10. Fixes CVE-2025-27113.

Fixed

Upgraded app-admin/google-guest-agent to v20250204.02.

Security

Fixed CVE-2025-0395 in sys-libs/glibc.

Change

Runtime sysctl changes:

Changed: fs.file-max: 811701 -> 811727

Fixed

Upgraded dev-libs/nss to v3.108.

Fixed

Disabled martian logging for ConnectX-7 network cards. These cards only communicate locally, but martian logging during communications with the host can lead to a race condition which causes GID table construction to sometimes fail.

Fixed

Upgraded chromeos-base/google-breakpad to v2024.02.16.014630-r227.

Fixed

Upgraded chromeos-base/chromeos-common-script to v0.0.1-r659.

Change

Upgrade cloud-init from 23.4.3 to 24.4.1.

Change

Fixed an issue that resulted in missing grub boot measurements in some machine configurations.

Fixed

Fixed a race condition that could cause a kernel panic.

Fixed

Upgraded chromeos-base/power_manager-client to v0.0.1-r2963.

Fixed

Upgraded chromeos-base/update_engine-client to v0.0.1-r2471.

Fixed

Upgraded chromeos-base/update_engine-client to v0.0.1-r2474.

Fixed

Upgraded chromeos-base/chromeos-common-script to v0.0.1-r657.

Feature

Added support for the Lustre 2.14.0 client drivers.

Fixed

Upgraded app-admin/google-guest-configs to v20250124.00.

Fixed

Upgraded sys-apps/diffutils to v3.11-r1.

Security

Upgrade sys-libs/binutils-libs to 2.44-r1. This fixes CVE-2024-53589.

Fixed

Upgraded sys-apps/dbus to v1.14.10-r194.

Fixed

Upgraded chromeos-base/debugd-client to v0.0.1-r2728.

Fixed

Upgraded sys-apps/diffutils to v3.11.

Fixed

Upgraded app-admin/google-guest-configs to v20250221.00.

Fixed

Upgraded chromeos-base/minijail to v18-r160.

Feature

Add support for iRDMA devices.

Fixed

Upgraded chromeos-base/session_manager-client to v0.0.1-r2821.

Fixed

Upgraded sys-apps/pv to v1.9.31.

Fixed

Upgraded app-admin/google-guest-agent to v20250225.00.

Fixed

Upgraded chromeos-base/power_manager-client to v0.0.1-r2961.

Security

Fixed CVE-2025-0840 in binutils.

Fixed

Upgraded app-containers/runc to v1.2.5, Upgraded app-containers/runc-test to v1.2.5.

Fixed

Upgraded chromeos-base/debugd-client to v0.0.1-r2726.

Fixed

Upgraded sys-apps/hwdata to v0.391.

Fixed

Upgraded app-containers/docker-credential-helpers to v0.9.2.

Fixed

Updated dev-python/python-dateutil to v2.9.0.

Fixed

Upgraded chromeos-base/session_manager-client to v0.0.1-r2820.

Feature

Added support for NVIDIA 570.124.06 GPU driver. Updated the LATEST GPU driver label to version 570.124.06 for all GPU devices. Updated the DEFAULT GPU driver label to version 570.124.06 for NVIDIA_B200 and NVIDIA_H200 GPU devices.

Fixed

Upgraded dev-libs/double-conversion to v3.3.1.

Security

Upgraded net-misc/openssh to version 9.9_p2. This fixed CVE-2025-26465 and CVE-2025-26466.

Fixed

Upgraded dev-db/sqlite to v3.47.2-r1.

Feature

Updated cos-gpu-installer to v2.4.8: Add the -skip-nvidia-smi flag to disable the execution of nvidia-smi verification during gpu driver installation.

Fixed

Upgraded chromeos-base/session_manager-client to v0.0.1-r2818.

Fixed

Upgraded sys-apps/which to v2.23.

Fixed

Upgraded sys-libs/libseccomp to v2.6.0-r1.

Fixed

Upgraded chromeos-base/shill-client to v0.0.1-r4818.

Security

Fixed CVE-2024-13176 in dev-libs/openssl.

Fixed

Upgraded app-admin/node-problem-detector to v0.8.20.

Security

Fixed CVE-2024-9287 in dev-lang/python.

Change

Updated the default tag of the GPU driver supporting the NVIDIA H200 GPU device to 570.86.15.

Fixed

Upgraded chromeos-base/chromeos-common-script to v0.0.1-r658.

Fixed

Upgraded chromeos-base/power_manager-client to v0.0.1-r2962.

Fixed

Upgraded chromeos-base/shill-client to v0.0.1-r4825.

Fixed

Updated dev-python/s3transfer to v0.11.4.

Fixed

Upgraded sys-apps/acl to v2.3.2-r2.

Fixed

Upgraded chromeos-base/update_engine-client to v0.0.1-r2470.

March 17, 2025

2025-03-17T00:00:00-07:00

Change

cos-dev-121-18867-0-53

Kernel	Docker	Containerd	GPU Drivers
COS-6.6.74	v27.5.1	v2.0.2	See List

Fixed

Upgraded net-misc/socat to v1.8.0.3.

Security

Upgraded net-misc/openssh to version 9.9_p2. This fixed CVE-2025-26465 and CVE-2025-26466.

Security

Upgraded dev-go/oauth2 to v0.27.0. This fixes CVE-2025-22868.

Security

Fixed CVE-2024-50014 in the Linux kernel.

Feature

Added support for iRDMA devices.

Security

Fixed CVE-2024-50017 in the Linux kernel.

Change

Upgraded app-containers/docker to v27.5.1, Upgraded app-containers/docker-test to v27.5.1, Upgraded app-containers/docker-cli to v27.5.1.

Security

Fixed KCTF-fcdd224 in the Linux kernel.

Security

Fixed CVE-2025-21745 in the Linux kernel.

Security

Upgraded dev-go/crypto to v0.35.0. This fixes CVE-2025-22869.

Security

Fixed CVE-2024-50304 in the Linux kernel.

Security

Fixed CVE-2025-21814 in the Linux kernel.

Security

Upgraded dev-libs/libxml2 to version 1.12.10. This fixes CVE-2025-27113.

Security

Fixed CVE-2025-21690 in the Linux kernel.

Fixed

Security

Fixed KCTF-638ba50 in the Linux kernel.

Security

Fixed CVE-2024-49994 in the Linux kernel.

Security

Fixed CVE-2024-50146 in the Linux kernel.

Feature

Applied Intel patches to add iRDMA support in the Linux kernel.

Feature

Updated cos-gpu-installer to v2.4.8: Add the -skip-nvidia-smi flag to disable the execution of nvidia-smi verification during gpu driver installation.

Security

Fixed KCTF-8802766 in the Linux kernel.

Security

Upgraded net-misc/wget to version 1.25.0. This fixes CVE-2024-10524.

Change

Runtime sysctl changes:

Changed: fs.file-max: 811788 -> 811701
Deleted: net.bridge.bridge-nf-call-arptables: 1
Deleted: net.bridge.bridge-nf-call-ip6tables: 1
Deleted: net.bridge.bridge-nf-call-iptables: 1
Deleted: net.bridge.bridge-nf-filter-pppoe-tagged: 0
Deleted: net.bridge.bridge-nf-filter-vlan-tagged: 0
Deleted: net.bridge.bridge-nf-pass-vlan-input-dev: 0

Security

Fixed CVE-2024-56549 in the Linux kernel.

Security

Upgrade sys-libs/binutils-libs to 2.44-r1. This fixes CVE-2024-53589.

Security

Fixed CVE-2024-58017 in the Linux kernel.

February 24, 2025

2025-02-24T00:00:00-08:00

Change

cos-dev-121-18867-0-24

Kernel	Docker	Containerd	GPU Drivers
COS-6.6.74	v25.0.7	v2.0.2	See List

Fixed

Upgraded sys-apps/diffutils to v3.11.

Fixed

Upgraded app-admin/fluent-bit to v3.2.5.

Change

Updated the default tag of the GPU driver supporting the NVIDIA H200 GPU device to 570.86.15.

Security

Fixed CVE-2024-9287 in dev-lang/python.

Change

Updated app-admin/google-guest-configs to v20250207.00.

Change

Updated Konlet to v0.13.4.

Feature

Updated cos-gpu-installer to v2.4.7: 1.Added Support for NVIDIA B200 GPU. 2.Enabled --prepare-build-tools flag to preload GPU driver metadata for ARM64

Change

Upgraded cloud-init from 23.4.3 to 24.4.1.

Change

Fixed CVE-2025-0840 in binutils.

Fixed

Upgraded sys-apps/pv to v1.9.27.

Feature

Support for NVIDIA B200 GPU – Added support for the R570 driver series, including version 570.86.15. This version has been assigned the latest, default, and R570 tags.

Change

Runtime sysctl changes:

Changed: fs.file-max: 811771 -> 811788

Security

Fixed CVE-2024-13176 in dev-libs/openssl.

Security

Fixed CVE-2025-0395 in sys-libs/glibc.

Fixed

Upgraded sys-apps/hwdata to v0.391.

Change

Upgraded app-admin/google-guest-agent to v20250204.02.

February 03, 2025

2025-02-03T00:00:00-08:00

Change

cos-dev-121-18865-0-0

Kernel	Docker	Containerd	GPU Drivers
COS-6.6.74	v25.0.7	v2.0.2	See List

Security

Fixed KCTF-bc50835 in the Linux kernel.

Feature

Enabled ECC kernel modules required for confidential GPU functionality.

Feature

Enabled Grace platform support: Enabled ATS/PASID(PCI) for ARM64 kernel.

Change

Updated the Linux kernel to v6.6.74.

Feature

Enabled Grace platform support: Enabled SMMU (v3) for ARM64 kernel.

Change

Runtime sysctl changes:

Changed: fs.file-max: 811821 -> 811771

Feature

Enabled Grace platform support: Enabled memory_hotplug and device_private in the ARM64 kernel.

Feature

Enabled Grace platform support: Enabled DMA-BUF shared memory support for the ARM64 kernel.

Feature

Added NVIDIA GPU driver's R570 branch. Updated the LATEST GPU driver label to version 570.86.15.

Feature

Backported Intel TDX (Trust Domain Extensions) and confidential computing patches from Linux kernel 6.7 upstream to enable TDX feature support.