Threats Tagged 'cve-2025-39946'

Published: 2025-10-16 Updated: 2026-03-24 Reference: CVE-2025-39946 2026-03-24 Update: Added patch versions for Ubuntu nodes with GKE. 2025-11-13 Update: Added patch versions for GDC software for VMware. GKE Updated: 2026-03-24 Description Severity The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes: CVE-2025-39946 GKE Standard and Autopilot clusters are impacted. Clusters using GKE Sandbox aren't impacted. What should I do? 2026-03-24 Update : The following versions of GKE are updated with code to fix this vulnerability on Ubuntu. Upgrade your Ubuntu node pools to the following versions or later: 1.35.2-gke.1269000 1.34.4-gke.1193000 1.33.8-gke.1169000 1.32.13-gke.1059000 The following minor versions are affected. Upgrade your Container-Optimized OS node pools to one of the following patch versions or later: 1.32.9-gke.1108000 1.29.15-gke.1989000 1.31.13-gke.1023000 1.30.14-gke.1336000 1.28.15-gke.2751000 1.34.1-gke.1279000 1.33.5-gke.1162000 You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see Run patch versions from a newer channel . High GDC (VMware) Updated: 2025-11-13 Description Severity The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes: CVE-2025-39946 What should I do? 2025-11-13 Update: The following versions of GDC software for VMware are updated with code to fix this vulnerability. Upgrade your GDC software for VMware clusters to the following versions or later: 1.31.1100-gke.40 Note: Patch versions and a severity assessment for GDC software for VMware are in progress. We'll update this bulletin with that information when it's available. High GKE on AWS Description Severity The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes: CVE-2025-39946 What should I do? Note: Patch versions and a severity assessment for GKE on AWS are in progress. We'll update this bulletin with that information when it's available. Pending GKE on Azure Description Severity The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes: CVE-2025-39946 What should I do? Note: Patch versions and a severity assessment for GKE on Azure are in progress. We'll update this bulletin with that information when it's available. Pending GDC (bare metal) Description Severity The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes: CVE-2025-39946 What should I do? There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution. None

In the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded recursion Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links. Currently, ep_loop_check_proc() ensures that the graph is loop-free and does some recursion depth checks, but those recursion depth checks don't limit the depth of the resulting tree for two reasons: - They don't look upwards in the tree. - If there are multiple downwards paths of different lengths, only one of the paths is actually considered for the depth check since commit 28d82dc1c4ed ("epoll: limit paths"). Essentially, the current recursion depth check in ep_loop_check_proc() just serves to prevent it from recursing too deeply while checking for loops. A more thorough check is done in reverse_path_check() after the new graph edge has already been created; this checks, among other things, that no paths going upwards from any non-epoll file with a length of more than 5 edges exist. However, this check does not apply to non-epoll files. As a result, it is possible to recurse to a depth of at least roughly 500, tested on v6.15. (I am unsure if deeper recursion is possible; and this may have changed with commit 8c44dac8add7 ("eventpoll: Fix priority inversion problem").) To fix it: 1. In ep_loop_check_proc(), note the subtree depth of each visited node, and use subtree depths for the total depth calculation even when a subtree has already been visited. 2. Add ep_get_upwards_depth_proc() for similarly determining the maximum depth of an upwards walk. 3. In ep_loop_check(), use these values to limit the total path length between epoll nodes to EP_MAX_NESTS edges.