GoogleAnalysisGoogle Cloud warns of Linux kernel TCP use-after-free flaw in GKE
What happened.Google Cloud published security bulletin GCP-2026-077 detailing a Linux kernel networking use-after-free vulnerability affecting Google Kubernetes Engine clusters.
Why it matters.Kubernetes worker nodes run shared container workloads across cloud environments. When external TCP handshakes corrupt kernel socket structures, attackers crash worker nodes or escape container boundaries to gain host root privileges. Cloud platform teams must upgrade GKE node images immediately. Infrastructure operators should audit VPC firewalls to block public ingress to node IP ranges.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-98432 with an 8.1 CVSS score, the defect involves a race condition in the IPv4 TCP stack receive socket function.
- Trigger conditions: Remote network attackers send crafted IPv4 TCP packets containing custom IP options to open network listeners on Kubernetes worker nodes.
- Impact scope: The memory corruption triggers kernel crashes or node-level privilege escalation, impacting GKE Standard and Autopilot clusters.
- Cloud mitigations: Google Cloud began rolling out patched node images and recommended restricting external TCP access via VPC firewall rules.
- Customer action: Cluster administrators must upgrade GKE node pools and block untrusted public traffic to node TCP listeners.