Security bulletins

A container breakout vulnerability CVE-2026-46300 has been found in the Linux kernel, known as Fragnesia. It allows an unprivileged local attacker to escalate to root on the host.

GKE Standard clusters with Ubuntu nodes are impacted. GKE Standard clusters with Container-Optimized OS nodes are not impacted. GKE Autopilot is not impacted.

Clusters using GKE Sandbox aren't impacted.

What should I do?

Upstream kernel patches have only recently been released. Those patches are being built into GKE releases and this bulletin will be updated when they are available. In the interim, partial mitigations are available below. Containers do not provide a robust security boundary, as container breakout vulnerabilities pose a significant risk. For secure workload isolation, we recommend using GKE Sandbox.

If possible, migrate your workloads to run as non-root. If your container needs to be root, consider setting the pod.spec.securityContext.seccompProfile.type to RuntimeDefault for all workloads in your cluster. As an added security measure, we also recommend setting the pod.spec.containers[*].securityContext.allowPrivilegeEscalation to false.

apiVersion: v1
kind: Pod
metadata:
  name: default-pod
spec:
  securityContext:
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: mycontainer
    image: ubuntu
    securityContext:
      allowPrivilegeEscalation: false

A container breakout vulnerability CVE-2026-46300 has been found in the Linux kernel, known as Fragnesia. It allows an unprivileged local attacker to escalate to root on the host.

What should I do?

A container breakout vulnerability CVE-2026-46300 has been found in the Linux kernel, known as Fragnesia. It allows an unprivileged local attacker to escalate to root on the host.

What should I do?

A container breakout vulnerability CVE-2026-46300 has been found in the Linux kernel, known as Fragnesia. It allows an unprivileged local attacker to escalate to root on the host.

What should I do?

A container breakout vulnerability CVE-2026-46300 has been found in the Linux kernel, known as Fragnesia. It allows an unprivileged local attacker to escalate to root on the host.

What should I do?

Container breakout vulnerabilities CVE-2026-43284 and CVE-2026-43500 have been found in the Linux kernel, known as DirtyFrag. They allow an unprivileged local attacker to escalate to root on the host.

There are two exploit paths.

rxrpc exploit path (CVE-2026-43500): Container-Optimized OS is not vulnerable because the vulnerable module is not compiled in. Ubuntu nodes are vulnerable.

esp4 exploit path (CVE-2026-43284): Both Container-Optimized OS and Ubuntu are vulnerable, but the GKE default seccomp profile provides a mitigation that protects all Autopilot clusters and Standard clusters with Autopilot-managed node pools. The esp4 exploit path requires the user to have the ability to make the unshare syscall to obtain CAP_NET_ADMIN. Containers that use the RuntimeDefault SeccompProfile can’t call unshare and are unaffected. Containers that grant CAP_NET_ADMIN explicitly are affected.

Containers using GKE Sandbox are not impacted.

What should I do?

2026-06-24 Update: The following versions of GKE are updated with code to fix this vulnerability on Container-Optimized OS. Upgrade your Container-Optimized OS node pools to the following versions or later:

• 1.30.14-gke.2558000
• 1.31.14-gke.1967000
• 1.32.13-gke.1829000
• 1.33.12-gke.1059000
• 1.34.8-gke.1218000
• 1.35.5-gke.1057000
• 1.36.0-gke.2459000

Upstream kernel patches have only recently been released. Those patches are being built into GKE releases and this bulletin will be updated when they are available. In the interim, partial mitigations are available below. We do not recommend relying on containers as a security boundary, container breakout vulnerabilities are very common. Use GKE Sandbox instead.

If possible, migrate your workloads to run as non-root. If your container needs to be root, consider setting the pod.spec.securityContext.seccompProfile.type to RuntimeDefault for all workloads in your cluster. As an added security measure we also recommend setting the pod.spec.containers[*].securityContext.allowPrivilegeEscalation to false.

apiVersion: v1
kind: Pod
metadata:
  name: default-pod
spec:
  securityContext:
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: mycontainer
    image: ubuntu
    securityContext:
      allowPrivilegeEscalation: false

Container breakout vulnerabilities CVE-2026-43284 and CVE-2026-43500 have been found in the Linux kernel, known as DirtyFrag. They allow an unprivileged local attacker to escalate to root on the host.

What should I do?

Container breakout vulnerabilities CVE-2026-43284 and CVE-2026-43500 have been found in the Linux kernel, known as DirtyFrag. They allow an unprivileged local attacker to escalate to root on the host.

What should I do?

Container breakout vulnerabilities CVE-2026-43284 and CVE-2026-43500 have been found in the Linux kernel, known as DirtyFrag. They allow an unprivileged local attacker to escalate to root on the host.

What should I do?

Container breakout vulnerabilities CVE-22026-43284 and CVE-2026-43500 have been found in the Linux kernel, known as DirtyFrag. They allow an unprivileged local attacker to escalate to root on the host.

What should I do?

There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution.

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23351

GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Unconfined profile or allow CAP_NET_ADMIN.

Clusters using GKE Sandbox aren't impacted.

What should I do?

The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:

• 1.35.3-gke.1389000
• 1.34.6-gke.1154000
• 1.33.10-gke.1115000
• 1.32.13-gke.1258000
• 1.31.14-gke.1723000
• 1.30.14-gke.2320000

You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel.

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23351

What should I do?

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23351

What should I do?

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23351

What should I do?

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23351

What should I do?

There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution.

A vulnerability in the Linux kernel (CVE-2026-31431) allows an unprivileged local attacker to write to the system page cache, potentially leading to local privilege escalation and container escape.

GKE Standard and Autopilot clusters are affected.

Containers using GKE Sandbox are not impacted.

What should I do?

2026-05-04 Update: The following versions of GKE are updated with code to fix this vulnerability on Container-Optimized OS. Upgrade your Container-Optimized OS node pools to the following versions or later:

• 1.36.0-gke.1555000
• 1.35.3-gke.1943000
• 1.34.7-gke.1292000
• 1.33.11-gke.1132000
• 1.32.13-gke.1446000
• 1.31.14-gke.1846000
• 1.30.14-gke.2439000

If you don't see these versions in the Google Cloud console, then use the gcloud container clusters upgrade gcloud CLI command to specify the versions and upgrade your node pools in Standard clusters and your control plane in Autopilot clusters.

Upstream kernel patches have only recently been released. Those patches are being built into GKE releases and this bulletin will be updated when they are available. In the interim, mitigations are available below.

We do not recommend relying on containers as a security boundary, container breakout vulnerabilities are very common. Use GKE Sandbox instead.

For immediate protection, mitigation advice here.

What vulnerabilities are being addressed?

The vulnerability, CVE-2026-31431, is a logic flaw in the Linux kernel's authencesn cryptographic template that chains AF_ALG and splice(). It allows an unprivileged local user to trigger a deterministic, controlled 4-byte write into the page cache of any readable file on the system. Because the page cache is shared across the host, an attacker can exploit this to achieve root privileges or escape container boundaries by corrupting the in-memory versions of setuid binaries or other sensitive files.

A vulnerability in the Linux kernel (CVE-2026-31431) allows an unprivileged local attacker to write to the system page cache, potentially leading to local privilege escalation and container escape.

What should I do?

Upstream kernel patches have only recently been released. Those patches are being built into GKE releases and this bulletin will be updated when they are available. In the interim, mitigations are available below.

We do not recommend relying on containers as a security boundary, container breakout vulnerabilities are very common. Use GKE Sandbox instead.

For immediate protection, mitigation advice here.

What vulnerabilities are being addressed?

The vulnerability, CVE-2026-31431, is a logic flaw in the Linux kernel's authencesn cryptographic template that chains AF_ALG and splice(). It allows an unprivileged local user to trigger a deterministic, controlled 4-byte write into the page cache of any readable file on the system. Because the page cache is shared across the host, an attacker can exploit this to achieve root privileges or escape container boundaries by corrupting the in-memory versions of sensitive files.

A vulnerability in the Linux kernel (CVE-2026-31431) allows an unprivileged local attacker to write to the system page cache, potentially leading to local privilege escalation and container escape.

What should I do?

Upstream kernel patches have only recently been released. Those patches are being built into GKE releases and this bulletin will be updated when they are available. In the interim, mitigations are available below.

We do not recommend relying on containers as a security boundary, container breakout vulnerabilities are very common. Use GKE Sandbox instead.

For immediate protection, mitigation advice here.

What vulnerabilities are being addressed?

The vulnerability, CVE-2026-31431, is a logic flaw in the Linux kernel's authencesn cryptographic template that chains AF_ALG and splice(). It allows an unprivileged local user to trigger a deterministic, controlled 4-byte write into the page cache of any readable file on the system. Because the page cache is shared across the host, an attacker can exploit this to achieve root privileges or escape container boundaries by corrupting the in-memory versions of sensitive files.

A vulnerability in the Linux kernel (CVE-2026-31431) allows an unprivileged local attacker to write to the system page cache, potentially leading to local privilege escalation and container escape.

What should I do?

Upstream kernel patches have only recently been released. Those patches are being built into GKE releases and this bulletin will be updated when they are available. In the interim, mitigations are available below.

We do not recommend relying on containers as a security boundary, container breakout vulnerabilities are very common. Use GKE Sandbox instead.

For immediate protection, mitigation advice here.

What vulnerabilities are being addressed?

The vulnerability, CVE-2026-31431, is a logic flaw in the Linux kernel's authencesn cryptographic template that chains AF_ALG and splice(). It allows an unprivileged local user to trigger a deterministic, controlled 4-byte write into the page cache of any readable file on the system. Because the page cache is shared across the host, an attacker can exploit this to achieve root privileges or escape container boundaries by corrupting the in-memory versions of sensitive files.

A vulnerability in the Linux kernel (CVE-2026-31431) allows an unprivileged local attacker to write to the system page cache, potentially leading to local privilege escalation and container escape.

What should I do?

GDC software for bare metal does not bundle an operating system in its distribution. Customers are responsible for installing and maintaining a supported Linux distribution on physical hardware.

To protect your cluster, check with your OS vendor to see if your underlying Linux distribution is affected, and apply the appropriate kernel updates.

As an immediate mitigation, mitigation advice here.

What vulnerabilities are being addressed?

The vulnerability, CVE-2026-31431, is a logic flaw in the Linux kernel's authencesn cryptographic template that chains AF_ALG and splice(). It allows an unprivileged local user to trigger a deterministic, controlled 4-byte write into the page cache of any readable file on the system. Because the page cache is shared across the host, an attacker can exploit this to achieve root privileges or escape container boundaries by corrupting the in-memory versions of sensitive files.

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23274

GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Unconfined profile or allow CAP_NET_ADMIN.

Clusters using GKE Sandbox aren't impacted.

What should I do?

The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:

• 1.35.3-gke.1389000
• 1.34.6-gke.1154000
• 1.33.10-gke.1115000
• 1.32.13-gke.1258000
• 1.31.14-gke.1723000
• 1.30.14-gke.2320000

You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel.

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23274

What should I do?

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23274

What should I do?

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23274

What should I do?

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23274

What should I do?

There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution.

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes:

• CVE-2025-38248

GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Unconfined profile or allow CAP_NET_ADMIN.

Clusters using GKE Sandbox aren't impacted.

What should I do?

The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:

• 1.35.2-gke.1485000
• 1.34.5-gke.1153000
• 1.33.9-gke.1117000
• 1.32.13-gke.1090000
• 1.31.14-gke.1526000
• 1.30.14-gke.2192000

The following minor versions are affected. Upgrade your Ubuntu node pools to one of the following patch versions or later:

• 1.35.2-gke.1485000
• 1.34.5-gke.1153000
• 1.33.9-gke.1117000
• 1.32.13-gke.1090000
• 1.31.14-gke.1526000
• 1.30.14-gke.2154000

You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel.

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes:

• CVE-2025-38248

What should I do?

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes:

• CVE-2025-38248

What should I do?

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes:

• CVE-2025-38248

What should I do?

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes:

• CVE-2025-38248

What should I do?

There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution.

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23074

GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Unconfined profile or allow CAP_NET_ADMIN.

Clusters using GKE Sandbox aren't impacted.

What should I do?

2026-05-07 Update: The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your Ubuntu node pools to the following versions or later:

• 1.30.14-gke.2320000
• 1.31.14-gke.1723000
• 1.32.13-gke.1258000
• 1.33.10-gke.1115000
• 1.34.6-gke.1154000
• 1.35.3-gke.1234000

The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:

• 1.35.2-gke.1485000
• 1.34.5-gke.1076000
• 1.33.9-gke.1060000
• 1.32.13-gke.1059000
• 1.31.14-gke.1476000
• 1.30.14-gke.2117000

You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel.

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23074

What should I do?

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23074

What should I do?

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23074

What should I do?

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23074

What should I do?

There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution.

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23209

GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Unconfined profile or allow CAP_NET_ADMIN.

Clusters using GKE Sandbox aren't impacted.

What should I do?

The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:

• 1.35.2-gke.1485000
• 1.34.5-gke.1153000
• 1.33.9-gke.1060000
• 1.32.13-gke.1059000
• 1.31.14-gke.1599000
• 1.30.14-gke.2215000

You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel.

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23209

What should I do?

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23209

What should I do?

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23209

What should I do?

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23209

What should I do?

There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution.

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23231

GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp Unconfined profile or allow CAP_NET_ADMIN.

Clusters using GKE Sandbox aren't impacted.

What should I do?

The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later:

• 1.35.2-gke.1485000
• 1.34.5-gke.1153000
• 1.33.10-gke.1067000
• 1.32.13-gke.1205000
• 1.31.14-gke.1681000
• 1.30.14-gke.2286000

You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel.

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23231

What should I do?

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23231

What should I do?

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23231

What should I do?

The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:

• CVE-2026-23231

What should I do?

There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution.