gcp Google Cloud release notes · Aug 6, 2026

Container Optimized OS Updates Include Kernel, Containerd, and Security Fixes

securityinfragcppreviewsecurity-advisoryengineermediaenergy

breaking security feature patch

This release of Container Optimized OS brings numerous updates, including kernel and Containerd version upgrades, alongside significant security patches for various components. These changes are particularly relevant for users managing containerized workloads on GCP infrastructure, aiming to enhance system stability and address known vulnerabilities. The updates include new features like TPUDirect support and zswap, alongside breaking changes affecting partition mounting options.

→cos-beta-133-19999-0-7
→cos-129-19506-299-82
→cos-dev-138-20012-0-0

Breaking changes (1) ›

Container Optimized OS

/dev/hugepages is now mounted with the noexec option.

Security (70) ›

Container Optimized OS

Fixed CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, and CVE-2026-46598 in dev-go/crypto.
Container Optimized OS

Fixed CVE-2026-58470 in net-misc/wget.
Container Optimized OS

Fixed CVE-2026-59890 in dev-python/setuptools.
Container Optimized OS

Fixed CVE-2026-64244 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64247 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64253 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64265 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64266 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64284 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64289 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64294 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64298 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64299 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64306 in the Linux kernel.
Container Optimized OS

Updated containerd to v2.3.2., containerd-test to v2.3.2.. This resolves CVE-2026-46680, CVE-2026-50195, CVE-2026-53488, CVE-2026-53492.
Container Optimized OS

Fixed CVE-2026-64313 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64317 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64319 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64320 in the Linux kernel.
Container Optimized OS

Updated app-arch/gzip to v1.14_p20260502, app-arch/xz-utils to v5.4.7, app-arch/zstd to v1.5.7, app-crypt/mit-krb5 to v1.22.2, app-editors/vim to v9.1.2148, app-editors/vim-core to v9.1.2148, dev-libs/libaio to v0.3.113-r2, dev-libs/xxhash to v0.8.3, dev-python/PySocks to v1.6.8, dev-python/markupsafe to v2.1.5, dev-python/pyrsistent to v0.14.11, dev-python/python-magic to v0.4.27, dev-python/pyyaml to v6.0.3, dev-python/rfc3339-validator to v0.1.4-r1, net-misc/rsync to v3.4.4, sys-apps/mawk to v1.3.4_p20260302, sys-libs/libxcrypt to v4.4.38, sys-libs/talloc to v2.4.4, sys-fs/lvm2 to v2.03.39,
Container Optimized OS

Fixed CVE-2026-64322 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64323 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64324 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64326 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64354 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64355 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64357 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64368 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64370 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64373 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64378 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64379 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64380 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64381 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64382 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-29111 in sys-apps/systemd
Container Optimized OS

Fixed CVE-2026-64383 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, and CVE-2026-46598 in dev-go/crypto.
Container Optimized OS

Fixed CVE-2026-64384 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-40225 in sys-apps/systemd.
Container Optimized OS

Fixed CVE-2026-64385 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-40355 and CVE-2026-40356 in app-crypt/mit-krb5.
Container Optimized OS

Fixed CVE-2026-64386 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-58469, CVE-2026-58471, CVE-2026-58472 in net-misc/wget.
Container Optimized OS

Fixed CVE-2026-64387 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-58470 in net-misc/wget.
Container Optimized OS

Fixed CVE-2026-64411 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-59890 in dev-python/setuptools.
Container Optimized OS

Fixed CVE-2026-64412 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64414 in the Linux kernel.
Container Optimized OS

Updated glib and gdbus-codegen to v2.89.1. This resolves CVE-2026-58013,CVE-2026-58014,CVE-2026-58015,CVE-2026-58016.
Container Optimized OS

Fixed CVE-2026-64415 in the Linux kernel.
Container Optimized OS

Upgraded net-misc/openssh to version 10.3_p1. This resolves CVE-2026-35387 and CVE-2026-35388.
Container Optimized OS

Fixed CVE-2026-64418 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64422 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64423 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64425 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64432 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64435 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64436 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64448 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64456 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64473 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64474 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64475 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64512 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64514 in the Linux kernel.
Container Optimized OS

Fixed CVE-2026-64556 in the Linux kernel.
Container Optimized OS

Upgraded net-libs/nghttp2 to 1.69.0 and fixed CVE-2026-58055.
Container Optimized OS

Updated containerd to v2.3.2., containerd-test to v2.3.2.. This resolves CVE-2026-35469, CVE-2026-46680, CVE-2026-50195, CVE-2026-53488, CVE-2026-53492.

Features (18) ›

Container Optimized OS

Added TPUDirect support.
Container Optimized OS

Added support for zswap in the Linux kernel.
Container Optimized OS

Enabled CONFIG_MEMORY_FAILURE in the Linux kernel for ARM64. This should improve memory errors handling when running CUDA workloads.
Container Optimized OS

Added TPUDirect support.
Container Optimized OS

Added nvidia-fs support to the COS GPU installer.
Container Optimized OS

Added support for 590.44.01 and 590.48.01 NVIDIA driver for NVIDIA_RTX_PRO_6000
Container Optimized OS

Added support for 8th generation TPU devices.
Container Optimized OS

Added support for NVIDIA driver v535.288.01, v570.211.01 and v580.126.09.
Container Optimized OS

Added support for larger ring sizes for the GVNIC driver in DQO-QPL mode.
Container Optimized OS

Added support for loading the ublk kernel module.
Container Optimized OS

Added support for zswap in the Linux kernel.
Container Optimized OS

Added the cos_kernel_args tool that allows manipulating kernel command line arguments of a COS image.
Container Optimized OS

Changed default sysctl networking values on A4x-max machine type only.
Container Optimized OS

Enabled CONFIG_MEMORY_FAILURE in the Linux kernel for ARM64. This should improve memory errors handling when running CUDA workloads.
Container Optimized OS

Enabled dynamic configuration of FUSE max pages limit.
Container Optimized OS

Enabled dynamic debug in the Linux kernel.
Container Optimized OS

Reverted iproute2 to v5.16.0.
Container Optimized OS

Switched to using systemd-resolved stub resolver by default, which fixes DNS caching issues.

Enhancements (47) ›

Container Optimized OS cos-beta-133-19999-0-7

Kernel Docker Containerd GPU Drivers COS-6.18.39 v29.4.3 v2.3.2 See List

GPU Drivers COS-6.18.39 See List
Container Optimized OS cos-129-19506-299-82

Kernel Docker Containerd GPU Drivers COS-6.12.94 v27.5.1 v2.2.6 See List

GPU Drivers COS-6.12.94 See List
Container Optimized OS cos-dev-138-20012-0-0

Kernel Docker Containerd GPU Drivers COS-6.18.41 v29.4.3 v2.3.2 See List

GPU Drivers COS-6.18.41 See List
Container Optimized OS

Updated containerd to v2.2.6.
Container Optimized OS

Added a splash screen which is displayed at login.
Container Optimized OS

Added a splash screen which is displayed at login.
Container Optimized OS

cchost: Add bpf-lsm-policy for VM restrictions.
Container Optimized OS

Added support for net-fs/lustre-client-drivers v2.14.0_p256.
Container Optimized OS

Added support for net-fs/lustre-client-drivers v2.14.0_p256.
Container Optimized OS

Added support for the swiotlb=any kernel command line parameter.
Container Optimized OS

Added support for the Lustre 2.14.0_p246 drivers.
Container Optimized OS

Updated google-guest-configs to v20260121.00.
Container Optimized OS

Added support for the Lustre 2.14.0_p249 drivers.
Container Optimized OS

Added support for the R595 Nvidia driver production branch.
Container Optimized OS

Updated the Linux kernel to v6.18.41.
Container Optimized OS

Added support for the swiotlb=any kernel command line parameter.
Container Optimized OS

cchost: Add bpf-lsm-policy for VM restrictions.
Container Optimized OS

Allow overriding IMA policy from oem partition.
Container Optimized OS

cchost: Increased the size of the kernel partitions from 16 MiB to 32 MiB.
Container Optimized OS

Apply hardening sysctls on cchost boards.
Container Optimized OS

Dropped support for the NVIDIA 535 drivers.
Container Optimized OS

Enabled mm hardening kernel cmdlines on cchost.
Container Optimized OS

Fixed the "CrackArmor" vulnerability in the Linux kernel.
Container Optimized OS

Fixes a kernel panic in virtio_pci teardown when virtually queues are conditionally skipped.
Container Optimized OS

Increased the size of the EFI partition from 32 MiB to 64 MiB and increased the sizes of both kernel partitions from 16 MiB to 32 MiB on x86.
Container Optimized OS

Made it so that /etc/machine-id is mounted with noexec, nosuid, and nodev.
Container Optimized OS

Made it so that /run is mounted as noexec.
Container Optimized OS

On cchost boards, autoload IMA policy on boot.
Container Optimized OS

Set static UUID for the stateful partition.
Container Optimized OS

Switch cchost-* boards to legacy iptables.
Container Optimized OS

Update sys-process/audit to v3.0.9.
Container Optimized OS

Updated app-containers/cloud-provider-gcp to v35.0.8, app-containers/docker-credential-gcr to v2.1.32, app-containers/nvidia-container-toolkit to v1.17.9, dev-python/oauthlib to v3.0.2, net-fs/nfs-utils to v2.6.4, sys-libs/libapparmor to v3.1.7..
Container Optimized OS

Updated dev-libs/libtraceevent to v1.7.3, dev-libs/libtracefs to v1.6.4, net-firewall/conntrack-tools to v1.4.9, sys-fs/fuse to v2.9.9, sys-fs/fuse-common to v3.10.5.
Container Optimized OS

Updated google-guest-configs to v20260121.00.
Container Optimized OS

Updated sys-apps/casfs to v0.1.14.
Container Optimized OS

Updated sys-libs/pam to v1.5.3.
Container Optimized OS

Updated the Linux kernel to v6.18.39.
Container Optimized OS

Updated uhaul to v6.18-0.
Container Optimized OS

Upgraded sys-apps/ek-cpu-balloon to v1.2.3.
Container Optimized OS

Upgraded sys-apps/iproute2 to version 6.18.0.
Container Optimized OS

Upgraded sys-apps/xemu to v0.0.9.
Container Optimized OS

Upgraded sys-fs/cryptsetup to v2.8.6.
Container Optimized OS

Upgraded sysram to v6.18-0.
Container Optimized OS

Runtime sysctl changes: Changed: fs.epoll.max_user_watches: 1808094 -> 1807627 Changed: fs.fanotify.max_user_marks: 68395 -> 68378 Changed: fs.inotify.max_user_watches: 64173 -> 64158 Changed: kernel.threads-max: 63460 -> 63443 Changed: net.ipv4.tcp_mem: 93993 125327 187986 -> 93969 125295 187938 Changed: net.ipv4.udp_mem: 187989 250655 375978 -> 187941 250590 375882 Changed: user.max_cgroup_namespaces: 31730 -> 31721 Changed: user.max_fanotify_marks: 68395 -> 68378 Changed: user.max_inotify_watches: 64173 -> 64158 Changed: user.max_ipc_namespaces: 31730 -> 31721
Container Optimized OS

cchost: Add bpf-lsm-policy for VM restrictions.
Container Optimized OS

cchost: Increased the size of the kernel partitions from 16 MiB to 32 MiB.
Container Optimized OS

Runtime sysctl changes: Changed: net.ipv4.udp_mem: 188034 250715 376068 -> 188034 250714 376068

Fixes (64) ›

Container Optimized OS

Added support for NVIDIA GRID driver version 580.159.03.
Container Optimized OS

Changed google-guest-agent's plugin installation path to /var/lib/google/guest-agent.
Container Optimized OS

Update udev rule for protected_stateful_partition
Container Optimized OS

Updated dev-cpp/abseil-cpp to v20230802.0; dev-libs/flatbuffersto v24.3.25; sys-devel/autofdo to v0.30-r12; media-libs/cros-camera-hal-fake to v0.0.1-r616; chromeos-base/chromeos-dbus-bindings to v0.0.1-r2800; chromeos-base/chromeos-installer to v0.1.0-r4432; chromeos-base/hardware_verifier_proto to v0.0.1-r819; chromeos-base/imageloader to v0.0.1-r2064; chromeos-base/libbrillo to v0.0.1-r2547; chromeos-base/libchrome to v0.0.1-r1242; chromeos-base/libhwsec-foundation to v0.0.1-r826; chromeos-base/libstorage to v0.0.1-r162; chromeos-base/metrics to v0.0.2-r3890; chromeos-base/perfetto to v48.1
Container Optimized OS

Updated dev-lang/rust, dev-lang/rust-host, dev-lang/rust-bootstrap to v1.84.1; dev-rust/protobuf-codegen to v2.28.0; dev-rust/system_api to v0.24.53-r1596; dev-rust/third-party-crates-src to v0.0.1-r288.
Container Optimized OS

Updated dev-libs/isa-l to v2.32.1.
Container Optimized OS

Updated sys-devel/gdb to v15.1; sys-apps/flashrom to v0.9.9-r1758; dev-python/cryptography to v43.0.3; Update dev-python/pyopenssl to v24.2.1.
Container Optimized OS

Updated sys-devel/llvm to v20.0_pre547379; sys-libs/compiler-rt to v20.0_pre547379; sys-libs/libcxx to v20.0_pre547379; sys-libs/llvm-libunwind to v20.0_pre547379.
Container Optimized OS

Upgrade Kubernetes to 1.36.1
Container Optimized OS

Upgraded app-admin/oslogin to v20260626.00.
Container Optimized OS

Upgraded app-crypt/sbsigntools to v0.42.0, and net-misc/m2crypto to v0.42.0.
Container Optimized OS

Upgraded chromeos-base/debugd-client to v0.0.1-r2739.
Container Optimized OS

Upgraded dev-db/sqlite to v3.53.3.
Container Optimized OS

Upgraded dev-libs/expat to v2.8.2.
Container Optimized OS

Upgraded dev-libs/openssl from v3.5.6 to v4.0.0.
Container Optimized OS

Upgraded net-misc/chrony to v4.8-r2.
Container Optimized OS

Upgraded net-misc/curl to 8.21.0.
Container Optimized OS

Upgraded net-misc/socat to v1.8.1.3.
Container Optimized OS

Upgraded sys-apps/acl to v2.4.0.
Container Optimized OS

Upgraded sys-apps/attr to v2.6.0.
Container Optimized OS

Added support for NVIDIA GRID driver version 580.159.03.
Container Optimized OS

Added support for NVIDIA driver v580.126.09-grid for NVIDIA_RTX_PRO_6000 GPU type.
Container Optimized OS

Added support for NVIDIA driver v580.159.03.
Container Optimized OS

Added support for NVIDIA driver v580.159.04.
Container Optimized OS

Added support for NVIDIA driver v595.71.05.
Container Optimized OS

Added support for NVIDIA drivers v580.126.16 and v580.126.20.
Container Optimized OS

Changed google-guest-agent's plugin installation path to /var/lib/google/guest-agent.
Container Optimized OS

Dropped support for NVIDIA MFT Tools v4.32.0.
Container Optimized OS

Enabled buffer overflow detection for kernel str/mem functions.
Container Optimized OS

Fixed a crash that occurs when using the configfile or source GRUB2 commands when Secure Boot is enabled.
Container Optimized OS

Fixed a kernel bug which could cause traffic drops after NIC resets.
Container Optimized OS

Fixed an ek-cpu-balloon bug which would result in CPUs being underreported on ek machines with SMT enabled.
Container Optimized OS

Update udev rule for protected_stateful_partition
Container Optimized OS

Updated dev-cpp/abseil-cpp to v20230802.0; dev-libs/flatbuffersto v24.3.25; sys-devel/autofdo to v0.30-r12; media-libs/cros-camera-hal-fake to v0.0.1-r616; chromeos-base/chromeos-dbus-bindings to v0.0.1-r2800; chromeos-base/chromeos-installer to v0.1.0-r4432; chromeos-base/hardware_verifier_proto to v0.0.1-r819; chromeos-base/imageloader to v0.0.1-r2064; chromeos-base/libbrillo to v0.0.1-r2547; chromeos-base/libchrome to v0.0.1-r1242; chromeos-base/libhwsec-foundation to v0.0.1-r826; chromeos-base/libstorage to v0.0.1-r162; chromeos-base/metrics to v0.0.2-r3890; chromeos-base/perfetto to v48.1
Container Optimized OS

Updated dev-lang/rust, dev-lang/rust-host, dev-lang/rust-bootstrap to v1.84.1; dev-rust/protobuf-codegen to v2.28.0; dev-rust/system_api to v0.24.53-r1596; dev-rust/third-party-crates-src to v0.0.1-r288.
Container Optimized OS

Updated dev-libs/isa-l to v2.32.1.
Container Optimized OS

Updated sys-devel/gdb to v15.1; sys-apps/flashrom to v0.9.9-r1758; dev-python/cryptography to v43.0.3; Update dev-python/pyopenssl to v24.2.1.
Container Optimized OS

Updated sys-devel/llvm to v20.0_pre547379; sys-libs/compiler-rt to v20.0_pre547379; sys-libs/libcxx to v20.0_pre547379; sys-libs/llvm-libunwind to v20.0_pre547379.
Container Optimized OS

Upgrade Kubernetes to 1.36.1
Container Optimized OS

Upgraded CASFS to v0.1.3.
Container Optimized OS

Upgraded app-admin/google-guest-agent to v20260121.00.
Container Optimized OS

Upgraded app-admin/google-osconfig-agent to v20260119.00.
Container Optimized OS

Upgraded app-admin/logrotate to v3.22.0-r1.
Container Optimized OS

Upgraded app-admin/oslogin to v20260626.00.
Container Optimized OS

Upgraded app-admin/sosreport to v4.11.2.
Container Optimized OS

Upgraded app-arch/unzip to v6.0_p29-r2.
Container Optimized OS

Upgraded app-containers/cni-plugins to v1.9.1.
Container Optimized OS

Upgraded app-containers/docker to v29.4.3, Upgraded app-containers/docker-test to v29.4.3, Upgraded app-containers/docker-cli to v29.4.3.
Container Optimized OS

Upgraded app-containers/docker-credential-helpers to v0.9.8.
Container Optimized OS

Upgraded app-crypt/sbsigntools to v0.42.0, and net-misc/m2crypto to v0.42.0.
Container Optimized OS

Upgraded app-emulation/cloud-init to v26.1.
Container Optimized OS

Upgraded app-shells/dash to v0.5.13.4-r2.
Container Optimized OS

Upgraded chromeos-base/chromeos-common-script to v0.0.1-r672.
Container Optimized OS

Upgraded chromeos-base/debugd-client to v0.0.1-r2739.
Container Optimized OS

Upgraded chromeos-base/google-breakpad to v2026.06.22.165940-r278.
Container Optimized OS

Upgraded chromeos-base/power_manager-client to v0.0.1-r2973.
Container Optimized OS

Upgraded chromeos-base/session_manager-client to v0.0.1-r2834.
Container Optimized OS

Upgraded cos-gpu-installer to v2.7.4.
Container Optimized OS

Upgraded dev-db/sqlite to v3.53.3.
Container Optimized OS

Upgraded dev-libs/expat to v2.8.2.
Container Optimized OS

Upgraded dev-libs/openssl from v3.5.6 to v4.0.0.
Container Optimized OS

Upgraded dev-util/gn to v2331.
Container Optimized OS

Upgraded dev-utils/gdbus-codegen to v2.86.3.
Container Optimized OS

Upgraded net-firewall/iptables to v1.8.13.

Read the original announcement →

https://docs.cloud.google.com/release-notes#August_04_2026

Related releases

Access Transparency for Firebase App Hosting enters Preview Google Cloud release notes · 50m ago
Error Reporting Adds Rust Stack Trace Support on GCP Google Cloud release notes · 50m ago
Firebase App Hosting Access Approval enters Preview Google Cloud release notes · 50m ago
Apigee X Maintenance Updates Begin for Instances with Preferred Windows Google Cloud release notes · 50m ago
Cloud Workstations adds Compute Engine VM suspend and resume in Preview Google Cloud release notes · 50m ago
Google Cloud IAM Workflow Updated for Workforce Identity Pool Providers Google Cloud release notes · 50m ago