GCP-2026-078 — Published: 2026-11-04Description Description Severity Notes A vulnerability (CVE-2026-98432) was discovered in the Linux kernel IPv4 TCP…

Published: 2026-11-04Description Description Severity Notes A vulnerability (CVE-2026-98432) was discovered in the Linux kernel IPv4 TCP stack. The flaw can cause a kernel panic or a container escape (root code execution on the node). An unprivileged process in a container can trigger it locally, without special capabilities such as CAP_NET_RAW. A network attacker can also trigger it by sending TCP packets with IPv4 options to a listener on the node or on the cluster control plane. The network attack requires access to a TCP listener on your nodes, Pods, or the control plane's IP-based endpoint. Clusters that restrict this access to trusted sources, for example with firewall rules and control plane authorized networks, are not exposed to network attacks. GKE Standard clusters and GKE Autopilot clusters are impacted. For instructions and more details, see the GKE security bulletin. Medium CVE-2026-98432