Vulnerabilities & Exploits

Google Cloud issues multiple Linux kernel privilege escalation fixes for GKE nodes

Google Cloud published several security bulletins addressing High-severity Linux kernel vulnerabilities that allow privilege escalation on Container-Optimized OS nodes used in Google Kubernetes Engine (GKE). These include CVE-2026-23273, CVE-2025-38616, and CVE-2026-23268 among others. The patches target Google-managed node images rather than just upstream kernel versions, meaning operators must verify and update GKE node images and node pool versions specifically. Ubuntu GKE nodes also received updated patch guidance.

This coordinated patch rollup shifts the focus from generic Linux kernel patching to cloud provider image management. Operators who only patch upstream OS packages may miss these fixes. Delayed updates could leave nodes vulnerable to privilege escalation, so checking node image versions and applying Google-provided updates is critical.

1 source · Apr 3

CVEs in this update

333 CVEs

Across VMware vCenter Server, VMware Cloud Foundation, VMware vCenter Server and VMware Cloud Foundation, sudo, and related packages.

18 critical · 171 high · 117 medium · 9 low

22 in CISA KEV · 124 with EPSS above 1%

21 with functional or packaged public exploit code

Highest severity: CVE-2025-55182 · 10.0 CRITICAL

Highest EPSS: CVE-2021-22005 · 100%

Showing the top 10 by KEV, EPSS, and severity.

Timeline

• Apr 3 Reported by Google Cloud Security Bulletins
• Dec 12 CISA federal deadline for CVE-2025-55182 passed
• Dec 5 CVE-2025-55182 added to CISA KEV
• Oct 27 CISA federal deadline for CVE-2025-61882 passed
• Oct 6 CVE-2025-61882 added to CISA KEV
• Oct 31 CISA federal deadline for CVE-2023-44487 passed
• Oct 10 CVE-2023-44487 added to CISA KEV
• Oct 4 CISA federal deadline for CVE-2023-4863 passed
• Sep 13 CVE-2023-4863 added to CISA KEV
• May 3 CISA federal deadline for CVE-2021-34527 passed
• Apr 27 CISA federal deadline for CVE-2021-3156 passed
• Apr 6 CVE-2021-3156 added to CISA KEV
• Nov 17 CISA federal deadline for CVE-2021-22005 passed
• Nov 3 CVE-2021-22005 added to CISA KEV

Sources

• Apr 3 Google Cloud Security Bulletins

  Security Bulletins | Cloud Customer Care | Google Cloud Documentation

  The following security bulletins are related to Google Cloud products.

  original

Part of the PlainSec briefing for 2026-04-07

Every edition of this story: Google Cloud issues multiple Linux kernel privilege escalation fixes for GKE nodes

More from today

• FortiClient EMS hotfixes leave uncertainty for 8.0 users
• AI workflow Builder flaw enables full server takeover
• Docker AuthZ bypass reopens host compromise risk