| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Clusters using GKE Sandbox aren't impacted. What should I do?The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Clusters using GKE Sandbox aren't impacted. What should I do?The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
2026-03-31 Update: Added patch versions for Ubuntu nodes with GKE.
Updated: 2026-03-31
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard and Autopilot clusters are impacted. Clusters using GKE Sandbox aren't impacted. What should I do?2026-03-31 Update: The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your Ubuntu node pools to the following versions or later:
The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
2026-03-25 Update: Added patch versions for Ubuntu nodes with GKE.
Updated: 2026-03-25
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Clusters using GKE Sandbox aren't impacted. What should I do?2026-03-25 Update: The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your Ubuntu node pools to the following versions or later:
The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
2026-03-25 Update: Added patch versions for Ubuntu nodes with GKE.
Updated: 2026-03-25
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Clusters using GKE Sandbox aren't impacted. What should I do?2026-03-25 Update: The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your Ubuntu node pools to the following versions or later:
The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
Updated: 2026-02-20
Reference: CVE-2025-154672026-02-20 Update: Added patch versions for GKE.
Updated: 2026-02-20
| Description | Severity |
|---|---|
|
Multiple security vulnerabilities have been identified in the OpenSSL library. The most significant finding is CVE-2025-15467, a critical vulnerability that might allow for remote code execution (RCE) or denial of service (DoS) attacks via network-based vectors. GKE control plane and infrastructure is not vulnerable. GKE core infrastructure, including the Kubernetes API Server and Kubelet, remains unaffected. These services use BoringCrypto (a security-hardened module derived from BoringSSL), which does not contain the vulnerable code found in the standard OpenSSL distribution. GKE Nodes: The OpenSSL library included in the GKE Node OS images (Container-Optimized OS and Ubuntu) contains the vulnerable code. While the control plane is secure, software running within your nodes or administrative tools on the host OS might be at risk. Updated GKE versions will include will the latest version of OpenSSL, which addresses the following CVEs:
What should I do?2026-02-20 Update: The following versions of GKE are updated with code to fix this vulnerability. Upgrade your GKE node pools to the following versions or later:
There is no action at this time. This security bulletin will be updated when new GKE versions are available that use the patched version of OpenSSL. |
High |
| Description | Severity |
|---|---|
|
Multiple security vulnerabilities have been identified in the OpenSSL library. The most significant finding is CVE-2025-15467, a critical vulnerability that might allow for remote code execution (RCE) or denial of service (DoS) attacks via network-based vectors. GDC software for VMware control plane and infrastructure is not vulnerable. GDC software for VMware core infrastructure, including the Kubernetes API Server and Kubelet, remains unaffected. These services use BoringCrypto (a security-hardened module derived from BoringSSL), which does not contain the vulnerable code found in the standard OpenSSL distribution. GDC software for VMware Nodes: The OpenSSL library included in the GDC software for VMware Node OS images (Container-Optimized OS and Ubuntu) contains the vulnerable code. While the control plane is secure, software running within your nodes or administrative tools on the host OS might be at risk. Updated GDC software for VMware versions will include will the latest version of OpenSSL, which addresses the following CVEs:
What should I do?There is no action at this time. This security bulletin will be updated when new Google Distributed Cloud versions are available that use the patched version of OpenSSL. |
High |
| Description | Severity |
|---|---|
|
Multiple security vulnerabilities have been identified in the OpenSSL library. The most significant finding is CVE-2025-15467, a critical vulnerability that might allow for remote code execution (RCE) or denial of service (DoS) attacks via network-based vectors. GKE on AWS control plane and infrastructure is not vulnerable. GKE on AWS core infrastructure, including the Kubernetes API Server and Kubelet, remains unaffected. These services use BoringCrypto (a security-hardened module derived from BoringSSL), which does not contain the vulnerable code found in the standard OpenSSL distribution. GKE on AWS Nodes: The OpenSSL library included in the GKE on AWS Node OS images (Container-Optimized OS and Ubuntu) contains the vulnerable code. While the control plane is secure, software running within your nodes or administrative tools on the host OS might be at risk. Updated GKE on AWS versions will include will the latest version of OpenSSL, which addresses the following CVEs:
What should I do?There is no action at this time. This security bulletin will be updated when new GKE on AWS versions are available that use the patched version of OpenSSL. |
High |
| Description | Severity |
|---|---|
|
Multiple security vulnerabilities have been identified in the OpenSSL library. The most significant finding is CVE-2025-15467, a critical vulnerability that might allow for remote code execution (RCE) or denial of service (DoS) attacks via network-based vectors. GKE on Azure control plane and infrastructure is not vulnerable. GKE on Azure core infrastructure, including the Kubernetes API Server and Kubelet, remains unaffected. These services use BoringCrypto (a security-hardened module derived from BoringSSL), which does not contain the vulnerable code found in the standard OpenSSL distribution. GKE on Azure Nodes: The OpenSSL library included in the GKE on Azure Node OS images (Container-Optimized OS and Ubuntu) contains the vulnerable code. While the control plane is secure, software running within your nodes or administrative tools on the host OS might be at risk. Updated GKE on Azure versions will include will the latest version of OpenSSL, which addresses the following CVEs:
What should I do?There is no action at this time. This security bulletin will be updated when new GKE on Azure versions are available that use the patched version of OpenSSL. |
High |
| Description | Severity |
|---|---|
|
Several security issues have been discovered in OpenSSL. The most critical is CVE-2025-15467, which could be used to execute a denial of service or remote code execution attack over the internet. GDC software for bare metal is not vulnerable to this threat. GDC software for bare metal uses BoringCrypto for network facing services such as the Kubernetes apiserver and Kubelet, and BoringCrypto is not affected by this vulnerability. BoringCrypto is extracted from BoringSSL, a fork of OpenSSL focused on security hardening and performance. GDC software for bare metal does not provide a node OS. Customers are responsible for installing and maintaining a supported Linux distribution on physical hardware before installing the GKE software. What should I do?Update your Linux OS image to one that includes the latest Open SSL distribution. |
High |
2026-03-25 Update: Added patch versions for Ubuntu nodes with GKE.
Updated: 2026-03-25
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard and Autopilot clusters are impacted. Clusters using GKE Sandbox aren't impacted. What should I do?2026-03-25 Update: The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your Ubuntu node pools to the following versions or later:
The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
2026-03-25 Update: Added patch versions for Ubuntu nodes with GKE.
Updated: 2026-03-25
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Clusters using GKE Sandbox aren't impacted. What should I do?2026-03-25 Update: The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your Ubuntu node pools to the following versions or later:
The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard and Autopilot clusters are impacted. Clusters using GKE Sandbox aren't impacted. What should I do?The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Clusters using GKE Sandbox aren't impacted. What should I do?The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
2026-03-25 Update: Added patch versions for Ubuntu nodes with GKE.
2025-12-11 Update: Added patch versions and a severity rating for GDC (VMware).
Updated: 2026-03-25
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard and Autopilot clusters are impacted. Clusters using GKE Sandbox aren't impacted. What should I do?2026-03-25 Update: The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your Ubuntu node pools to the following versions or later:
The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
Updated: 2025-12-11
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?The following versions of GDC (VMware) are updated with code to fix this vulnerability. Upgrade your GDC (VMware) clusters to the following versions or later:
|
High |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
2026-03-25 Update: Added patch versions for Ubuntu nodes with GKE.
2025-12-11 Update: Added patch versions and a severity rating for GDC (VMware).
Updated: 2026-03-25
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Clusters using GKE Sandbox aren't impacted. What should I do?2026-03-25 Update: The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your Ubuntu node pools to the following versions or later:
The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
Updated: 2025-12-11
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?The following versions of GDC (VMware) are updated with code to fix this vulnerability. Upgrade your GDC (VMware) clusters to the following versions or later:
|
High |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
2025-11-27 Update: Added patch versions for GKE and GDC (bare metal).
Updated: 2025-11-27
| Description | Severity |
|---|---|
|
Several security issues have been discovered in runc, an open source software component used for running containers on GKE. The vulnerabilities (CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881) allow an attacker to execute a full container breakout, leading to root privilege escalation on the host node. An actor with privileges to deploy a malicious container image can exploit these vulnerabilities. These vulnerabilities affect GKE Standard clusters running either Container-Optimized OS (COS) or Ubuntu node images, as well as Autopilot clusters. Node pools using GKE Sandbox are not affected and Windows node pools are not affected. What should I do?2025-11-27 Update: The following versions of GKE are updated with code to fix these vulnerabilities on Container-Optimized OS. Upgrade your GKE node pools to the following versions or later:
The following GKE versions have been updated with code to fix these vulnerabilities on Ubuntu. Upgrade your GKE node pools to the following versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. GKE is developing new versions that include the fixes for these vulnerabilities. This bulletin will be updated once these new versions are available. |
High |
| Description | Severity |
|---|---|
|
Several security issues have been discovered in runc, an open source software component used for running containers on GKE. The vulnerabilities (CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881) allow an attacker to execute a full container breakout, leading to root privilege escalation on the host node. An actor with privileges to deploy a malicious container image can exploit these vulnerabilities. What should I do? GKE is developing new versions that include the fixes for these vulnerabilities. This bulletin will be updated once these new versions are available. |
High |
| Description | Severity |
|---|---|
|
Several security issues have been discovered in runc, an open source software component used for running containers on GKE. The vulnerabilities (CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881) allow an attacker to execute a full container breakout, leading to root privilege escalation on the host node. An actor with privileges to deploy a malicious container image can exploit these vulnerabilities. What should I do? GKE is developing new versions that include the fixes for these vulnerabilities. This bulletin will be updated once these new versions are available. |
High |
| Description | Severity |
|---|---|
|
Several security issues have been discovered in runc, an open source software component used for running containers on GKE. The vulnerabilities (CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881) allow an attacker to execute a full container breakout, leading to root privilege escalation on the host node. An actor with privileges to deploy a malicious container image can exploit these vulnerabilities. What should I do? GKE is developing new versions that include the fixes for these vulnerabilities. This bulletin will be updated once these new versions are available. |
High |
Updated: 2025-11-27
| Description | Severity |
|---|---|
|
Several security issues have been discovered in runc, an open source software component used for running containers on GKE. The vulnerabilities (CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881) allow an attacker to execute a full container breakout, leading to root privilege escalation on the host node. An actor with privileges to deploy a malicious container image can exploit these vulnerabilities. What should I do?2025-11-27 Update: The following versions of GDC (bare metal) are updated with code to fix this vulnerability. Upgrade your GDC (bare metal) clusters to these versions or later:
GKE is developing new versions that include the fixes for these vulnerabilities. This bulletin will be updated once these new versions are available. |
High |
2025-10-30 Update: Added patch versions and a severity rating for GDC software for VMware.
Updated: 2025-11-17
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard and Autopilot clusters are impacted. Clusters using GKE Sandbox aren't impacted. What should I do?2025-11-17 Update: The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your Ubuntu node pools to the following versions or later:
The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
Updated: 2025-10-30
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?2025-10-30 Update: The following versions of GDC software for VMware are updated with code to fix this vulnerability. Upgrade your GDC software for VMware clusters to these versions or later:
|
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
2025-10-30 Update: Added patch versions for Ubuntu nodes on GKE, and patch versions and a severity rating for GDC software for VMware.
Updated: 2025-10-30
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard and Autopilot clusters are impacted. Clusters using GKE Sandbox aren't impacted. What should I do?2025-10-30 Update: The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your Ubuntu node pools to these versions or later:
The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
Updated: 2025-10-30
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?2025-10-30 Update: The following versions of GDC software for VMware are updated with code to fix this vulnerability. Upgrade your GDC software for VMware clusters to these versions or later:
|
High |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
2025-11-11 Update: Added patch versions for Ubuntu node pools in GKE.
2025-10-27 Update: Added patch versions and a severity rating for GDC software for VMware.
Updated: 2025-11-11
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard and Autopilot clusters are impacted. Clusters using GKE Sandbox aren't impacted. What should I do?2025-11-11 Update: The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your Ubuntu node pools to the following versions or later:
The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
Updated: 2025-10-27
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?2025-10-27 Update: The following versions of GDC software for VMware are updated with code to fix this vulnerability. Upgrade your GDC software for VMware clusters to these versions or later:
|
High |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
2026-03-24 Update: Added patch versions for Ubuntu nodes with GKE.
2025-11-13 Update: Added patch versions for GDC software for VMware.
Updated: 2026-03-24
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard and Autopilot clusters are impacted. Clusters using GKE Sandbox aren't impacted. What should I do?2026-03-24 Update: The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your Ubuntu node pools to the following versions or later:
The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
Updated: 2025-11-13
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?2025-11-13 Update: The following versions of GDC software for VMware are updated with code to fix this vulnerability. Upgrade your GDC software for VMware clusters to the following versions or later:
|
High |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
2025-11-11 Update: Added patch versions for Ubuntu node pools in GKE.
2025-10-16 Update: Added patch versions and a severity rating for GDC software for VMware.
Updated: 2025-11-11
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Clusters using GKE Sandbox aren't impacted. What should I do?2025-11-11 Update: The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your Ubuntu node pools to the following versions or later:
The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
Updated: 2025-10-16
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?2025-10-16 Update: The following versions of GDC software for VMware are updated with code to fix this vulnerability. Upgrade your GDC software for VMware clusters to the following versions or later:
|
High |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
2025-11-11 Update: Added patch versions for Ubuntu node pools in GKE.
2025-10-16 Update: Added patch versions and a severity rating for GDC software for VMware.
Updated: 2025-11-11
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Clusters using GKE Sandbox aren't impacted. What should I do?2025-11-11 Update: The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your Ubuntu node pools to the following versions or later:
The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
Updated: 2025-10-16
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?2025-10-16 Update: The following versions of GDC software for VMware are updated with code to fix this vulnerability. Upgrade your GDC software for VMware clusters to the following versions or later:
|
High |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
2025-09-25 Update: Added patch versions for Ubuntu node pools on GKE.
Updated: 2025-09-25
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Clusters using GKE Sandbox aren't impacted. What should I do?2025-09-25 Update: The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your Ubuntu node pools to the following versions or later:
The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
2025-11-11 Update: Added patch versions for Ubuntu node pools in GKE.
2025-10-16 Update: Added patch versions and a severity rating for GDC software for VMware.
Updated: 2025-11-11
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Clusters using GKE Sandbox aren't impacted. What should I do?2025-11-11 Update: The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your Ubuntu node pools to the following versions or later:
The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
Updated: 2025-10-16
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?2025-10-16 Update: The following versions of GDC software for VMware are updated with code to fix this vulnerability. Upgrade your GDC software for VMware clusters to the following versions or later:
|
High |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
2025-11-10 Update: Added patch versions for GDC software for VMware.
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Ubuntu nodes:
GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Clusters using GKE Sandbox aren't impacted. What should I do?The following minor versions are affected. Upgrade your Ubuntu node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
Updated: 2025-11-10
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Ubuntu nodes:
What should I do?2025-11-10 Update: The following versions of GDC software for VMware are updated with code to fix this vulnerability. Upgrade your GDC software for VMware clusters to the following versions or later:
|
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Ubuntu nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Ubuntu nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Ubuntu nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
2025-11-10 Update: Added patch versions for GDC software for VMware.
2025-08-28 Update: Added patch versions for Ubuntu node pools on GKE.
Updated: 2025-08-28
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Clusters using GKE Sandbox aren't impacted. What should I do?2025-08-28 Update: The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your Ubuntu node pools to the following versions or later:
The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
Updated: 2025-11-10
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?2025-11-10 Update: The following versions of GDC software for VMware are updated with code to fix this vulnerability. Upgrade your GDC software for VMware clusters to the following versions or later:
|
High |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
2025-09-25 Update: Added patch versions for Ubuntu node pools on GKE.
Updated: 2025-09-25
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Clusters using GKE Sandbox aren't impacted. What should I do?2025-09-25 Update: The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your Ubuntu node pools to the following versions or later:
The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
2025-11-10 Update: Added patch versions for GDC software for VMware.
2025-07-21 Update: Added patch versions for Ubuntu node pools on GKE.
Updated: 2025-07-21
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Clusters using GKE Sandbox aren't impacted. What should I do?2025-07-21 Update: The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your GKE Ubuntu node pools to the following versions or later:
The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
Updated: 2025-11-10
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?2025-11-10 Update: The following versions of GDC software for VMware are updated with code to fix this vulnerability. Upgrade your GDC software for VMware clusters to the following versions or later:
|
High |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
2025-11-10 Update: Added patch versions for GDC software for VMware.
2025-07-21 Update: Added patch versions for Ubuntu node pools on GKE.
Updated: 2025-07-21
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Clusters using GKE Sandbox aren't impacted. What should I do?2025-07-21 Update: The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your GKE Ubuntu node pools to the following versions or later:
The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
Updated: 2025-11-10
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?2025-11-10 Update: The following versions of GDC software for VMware are updated with code to fix this vulnerability. Upgrade your GDC software for VMware clusters to the following versions or later:
|
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
2025-07-21 Update: Added patch versions for Ubuntu node pools on GKE.
Updated: 2025-07-21
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Clusters using GKE Sandbox aren't impacted. What should I do?2025-07-21 Update: The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your GKE Ubuntu node pools to the following versions or later:
The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
| Description | Severity |
|---|---|
|
A security issue was discovered where attackers might be able to bypass workload isolation restrictions on GKE clusters. Only clusters relying on node isolation to separate workloads inside a cluster are affected. Note that node isolation should never be used as a primary security boundary. To exploit this vulnerability, attackers must first gain access to the kubelet node client credentials. Access to these credentials typically requires root permissions on the host and access to the host filesystem. For most systems, this means you need both an application vulnerability to gain access to the workload and a container breakout vulnerability to gain access to the host. Attackers with access to such credentials could do the following:
What should I do?Implement the following changes to address this issue: Upgrade your GKE cluster and optionally implement validating admission policy
Address the provider ID issue by upgrading your GKE clusters to a patched version. The
following versions of GKE or later have been updated to address the
Optionally, if you cannot upgrade, implement the following validating admission policy on your cluster to mitigate the apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicy metadata: name: validate-node-providerid spec: failurePolicy: Fail matchConstraints: resourceRules: - apiGroups: [""] apiVersions: ["v1"] operations: ["CREATE", "UPDATE"] resources: ["nodes"] matchConditions: - name: "has-providerid" expression: "has(object.spec.providerID)" validations: - expression: "object.spec.providerID == '' || object.spec.providerID.endsWith('/' + object.metadata.name)" message: "node.spec.providerID must match the node name" --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicyBinding metadata: name: validate-node-providerid-binding spec: policyName: validate-node-providerid validationActions: [Deny] Use node restricted labels when isolating workloads to specific nodes as a security control
If you are using labels for node isolation, as described in
Kubernetes documentation,
use node restricted labels (for example, labels of the form Kubelet node credentials are prevented from applying such labels by the NodeRestriction admission controller. The NodeRestriction admission controller is built into Kubernetes and enabled on all GKE clusters. GKE restricts the scope of node credentials on newly created nodes for new clusters
As an additional hardening measure, new clusters starting from GKE version
1.33.1-gke.1386000 restrict the scope of node credentials on newly created nodes. Node
credentials are bound to the Compute Engine instance originally provisioned for the Node. After the
instance is deleted, attackers are prevented from using such compromised credentials to
register the Node, with attacker controlled taints or |
Medium |
| Description | Severity |
|---|---|
|
A security issue was discovered where attackers might be able to bypass workload isolation restrictions on GKE clusters. What should I do?No action required. This issue is specific to how GKE nodes are provisioned and managed on Compute Engine, and does not apply to GDC (VMware). |
None |
| Description | Severity |
|---|---|
|
A security issue was discovered where attackers might be able to bypass workload isolation restrictions on GKE clusters. What should I do?GKE on AWSNo action required. This issue is specific to how GKE nodes are provisioned and managed on Compute Engine, and does not apply to GKE on AWS. GKE on AWS (previous generation)No action required. This issue is specific to how GKE nodes are provisioned and managed on Compute Engine, and does not apply to GKE on AWS (previous generation). |
None |
| Description | Severity |
|---|---|
|
A security issue was discovered where attackers might be able to bypass workload isolation restrictions on GKE clusters. What should I do?No action required. This issue is specific to how GKE nodes are provisioned and managed on Compute Engine, and does not apply to GKE on Azure. |
None |
| Description | Severity |
|---|---|
|
A security issue was discovered where attackers might be able to bypass workload isolation restrictions on GKE clusters. What should I do?No action required. This issue is specific to how GKE nodes are provisioned and managed on Compute Engine, and does not apply to GDC (bare metal). |
None |
2025-07-21 Update: Added patch versions for Ubuntu node pools on GKE.
Updated: 2025-07-21
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Clusters using GKE Sandbox aren't impacted. What should I do?2025-07-21 Update: The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your GKE Ubuntu node pools to the following versions or later:
The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |
2025-08-26 Update: Added patch versions for Ubuntu node pools on GKE.
Updated: 2025-08-26
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Clusters using GKE Sandbox aren't impacted. What should I do?2025-08-26 Update: The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your Ubuntu node pools to the following versions or later:
The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:
You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel. |
High |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do? |
Pending |
| Description | Severity |
|---|---|
|
The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:
What should I do?There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. |
None |