Security Advisory: CVE-2026-31431 (Copy Fail), CVE-2026-43284 (Dirty Frag), CVE-2026-46300 (Fragnesia)

[kadupoornima]

Security Advisory

This is an Infrastructure Security Update in light of the two high-priority vulnerabilities discovered in the Linux kernel: CVE-2026-31431 (Copy Fail Vulnerability), CVE-2026-43284 (Dirty Frag Vulnerability), and CVE-2026-46300 (Fragnesia Vulnerability).

While these vulnerabilities do not reside within the Cluster Toolkit code itself, they impact the underlying Linux distributions (Ubuntu, Rocky Linux, and Debian) and Container OS.

Impact on Clusters: The risk is primarily centered on unauthorized privilege escalation and cross-tenant data exposure.

• GKE-based Clusters: Nodes running affected kernel versions are vulnerable. GKE Autopilot and managed node pools will require automated or manual rolls.
• Slurm/Compute Engine Clusters: Static and dynamic compute nodes using affected images must be patched at the OS level.

Recommended Actions: We recommend all users verify their current kernel versions against the official Google Cloud security bulletins.

• Google Kubernetes Engine (GKE) Security Bulletins
• Compute Engine (GCE) Security Bulletins

Upcoming Toolkit Support: The Cluster Toolkit team is actively working on documented "how-to" guides for our users. Detailed advisories and upgrade instructions specifically tailored for GKE and Slurm Clusters will follow shortly in separate updates.

[vikramvs-gg]

Vulnerability Details & Manual Mitigations for Slurm Clusters (Optional)

For users managing Slurm/Compute Engine clusters with Ubuntu as the base OS who are interested in additional vulnerability analysis or official manual mitigation steps, please refer directly to the official Canonical advisories. Applying these mitigations is at the user's discretion based on specific cluster requirements:

• Copy Fail (CVE-2026-31431): Official Ubuntu Advisory & Fixes
• Dirty Frag (CVE-2026-43284): Official Ubuntu Advisory & Fixes
• Fragnesia (CVE-2026-46300): Official Ubuntu Advisory & Fixes

[shubpal07]

Security Advisory (June 3, 2026): Mitigations for GKE "Copy Fail" (CVE-2026-31431)

Hello everyone,

Following up on our initial notification, we are releasing guidance and GKE version mapping to help our community apply security updates for the Linux kernel Copy Fail vulnerability (CVE-2026-31431) in GKE environments.

Standard Cluster Toolkit blueprints deploy resources into GKE's default REGULAR release channel. These clusters will automatically receive security updates as part of GKE's standard release cycle.

However, if your security policies require immediate proactive mitigation, you can explicitly pin your cluster to a patched version. To help you do this safely without disrupting workloads or causing Terraform state drift, we have published a comprehensive GKE Upgrade User Guide

---

Patched GKE Version Ranges

The following GKE patch versions (or later) containing the security updates are officially published in GKE Security Bulletin GCP-2026-026:

• GKE 1.36: 1.36.0-gke.1555000 or later
• GKE 1.35: 1.35.3-gke.1943000 or later
• GKE 1.34: 1.34.7-gke.1292000 or later
• GKE 1.33: 1.33.11-gke.1132000 or later
• GKE 1.32: 1.32.13-gke.1446000 or later
• GKE 1.31: 1.31.14-gke.1846000 or later
• GKE 1.30: 1.30.14-gke.2439000 or later

---

High-Level Upgrade Workflows

Please refer to the GKE Upgrade User Guide for the complete, step-by-step upgrade procedures. The guide outlines two upgrade pathways depending on your operational requirements:

1. Blueprint-Based Upgrades:
   • Summary: Proactively modify GKE version variables (e.g. version_prefix) inside your local Cluster Toolkit blueprint file to match one of the patched ranges listed above, then redeploy using ./gcluster deploy.
   • Advantage: Keeps your infrastructure-as-code (Terraform state files) synchronized with your GKE cluster's actual state, preventing configuration drift.
2. Manual Upgrades:
   • Summary: Upgrade cluster control planes and node pools immediately using gcloud container clusters upgrade commands or the Google Cloud Console UI.
   • Important Note: If manual upgrades are applied directly to the active GKE resource, please ensure you reconcile your local blueprint configuration immediately afterward as explained in the guide to prevent subsequent toolkit runs from attempting to revert node configurations.

Distributed Workload Advisory: If you are upgrading GKE node pools currently running active GPU or TPU training workloads, please follow the workload-draining and pause warnings inside the upgrade guide to avoid job interruption.

For detailed command sequences and maintenance guidelines, please review the GKE Upgrade User Guide.

[Neelabh94]

Security Advisory Update (July 26, 2026): Mitigations for GKE "Dirty Frag" (CVE-2026-43284) and "Fragnesia" (CVE-2026-46300)

Hello everyone,

Following up on our previous updates, GKE has now released the official patch versions addressing the remaining two vulnerabilities: Dirty Frag (CVE-2026-43284) and Fragnesia (CVE-2026-46300).

If your security policies require immediate proactive mitigation, please review the patched versions below and update your clusters.

Patched GKE Version Ranges

For "Dirty Frag" (CVE-2026-43284) on Container-Optimized OS (COS)
The following GKE patch versions (or later) contain the security updates for COS, as published in GKE Security Bulletin GCP-2026-030:

GKE 1.36: 1.36.0-gke.2459000 or later
GKE 1.35: 1.35.5-gke.1057000 or later
GKE 1.34: 1.34.8-gke.1218000 or later
GKE 1.33: 1.33.12-gke.1059000 or later
GKE 1.32: 1.32.13-gke.1829000 or later
GKE 1.31: 1.31.14-gke.1967000 or later
GKE 1.30: 1.30.14-gke.2558000 or later

For "Fragnesia" (CVE-2026-46300) on Ubuntu
The following GKE patch versions (or later) contain the security updates for Ubuntu nodes, as published in GKE Security Bulletin GCP-2026-033:

GKE 1.36: 1.36.2-gke.1346000 or later
GKE 1.35: 1.35.6-gke.1127000 or later
GKE 1.34: 1.34.9-gke.1131000 or later
GKE 1.33: 1.33.13-gke.1011000 or later
GKE 1.32: 1.32.13-gke.1829000 or later
GKE 1.31: 1.31.14-gke.2116000 or later
GKE 1.30: 1.30.14-gke.2710000 or later

Upgrade Instructions

To apply these patches, please follow the exact same Blueprint-Based or Manual upgrade workflows detailed in our GKE Upgrade User Guide.

For a quick summary of the steps and distributed workload advisories, please refer to the "High-Level Upgrade Workflows" section in the previous comment above.