CVE-2025-40214 is a vulnerability in the Linux kernel affecting the Unix domain sockets subsystem, specifically due to uninitialized scc_index in the unix_add_edge() function. This flaw can lead to privilege escalation on Container-Optimized OS nodes used in GKE Standard and Autopilot clusters. The vulnerability has a CVSS 3.1 score of 7.8 (high severity) with attack vector local, low attack complexity, requiring low privileges, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Multiple patch versions for Container-Optimized OS node pools and Ubuntu Linux kernel packages have been released to address this issue. Bare metal GDC software is unaffected as it does not bundle an OS. Patch versions for VMware, GKE on AWS, and GKE on Azure are pending. The Ubuntu advisory USN-8014-1 details the fixes and upgrade instructions, including a required reboot and recompilation of third-party kernel modules due to ABI changes.

Successful exploitation of this vulnerability could allow a local attacker with low privileges to escalate their privileges on affected Container-Optimized OS nodes, potentially compromising system confidentiality, integrity, and availability. GKE Standard and Autopilot clusters are impacted, while GKE Sandbox clusters and bare metal GDC software are not affected. No known exploits in the wild have been reported at this time.

A fix is available. Users should upgrade Container-Optimized OS node pools to the specified patched versions or later, as listed in the advisory, and reboot their systems to apply the updates. For Ubuntu systems, update to the Linux kernel package versions specified in Ubuntu Security Notice USN-8014-1 and reboot. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. For VMware, GKE on AWS, and GKE on Azure, patch versions and severity assessments are pending; monitor vendor advisories for updates. Bare metal GDC users require no action as they are not affected.