Cloud service vulnerability, severity high
GKE Linux kernel IPv4 TCP flaw (CVE-2026-98432) allows container escape and node panic
Published
Google Cloud bulletin GCP-2026-078 describes a Linux kernel IPv4 TCP stack vulnerability (CVE-2026-98432) that can cause a kernel panic or a container escape with root code execution on the node. An unprivileged process in a container can trigger it locally, and a network attacker can trigger it with TCP packets carrying IPv4 options sent to a listener on nodes, Pods or the control plane endpoint. GKE Standard and GKE Autopilot clusters are impacted.
What's affected
- gcp gke kubernetesevery version
What to do
- Follow the instructions in the GKE security bulletin for GCP-2026-078
- Restrict access to TCP listeners on nodes, Pods and the control plane to trusted sources using firewall rules
- Use control plane authorized networks to limit network exposure
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:
/pharon:check-incident gke-linux-kernel-ipv4-tcp-escape-2026-11References
Notice gke-linux-kernel-ipv4-tcp-escape-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.