Ubuntu GKE Kernel Update Fixes 101 Vulnerabilities

Quick Answer

Ubuntu USN-8816-4 lists 101 fixes for the Ubuntu 26.04 GKE kernel stream, with binary image builds 7.0.0-1007.8. The name linux-gke identifies source packaging. Select the installed architecture and ordinary or 64k flavour; the USN does not establish which Google-managed node image has already rolled out the fixes.

Last verified: 2026-10-02 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.

Scope And Authority

Product scope	Ubuntu 26.04 LTS GKE kernel
Advisory	USN-8816-4
CVEs	CVE-2026-64530, CVE-2026-64534, CVE-2026-64535, CVE-2026-64541, CVE-2026-64551, CVE-2026-68083, CVE-2026-68457, CVE-2026-68476, CVE-2026-68477, CVE-2026-72014, CVE-2026-72020, CVE-2026-72033, CVE-2026-72041, CVE-2026-72046, CVE-2026-72064, CVE-2026-72065, CVE-2026-72069, CVE-2026-72083, CVE-2026-72084, CVE-2026-72085, CVE-2026-72098, CVE-2026-72129, CVE-2026-72130, CVE-2026-72137, CVE-2026-72139, CVE-2026-72191, CVE-2026-72192, CVE-2026-72194, CVE-2026-72217, CVE-2026-72220, CVE-2026-72221, CVE-2026-72222, CVE-2026-72226, CVE-2026-72234, CVE-2026-72248, CVE-2026-72249, CVE-2026-72251, CVE-2026-72277, CVE-2026-72278, CVE-2026-72279, CVE-2026-72287, CVE-2026-72288, CVE-2026-72289, CVE-2026-72296, CVE-2026-72299, CVE-2026-72317, CVE-2026-72318, CVE-2026-72319, CVE-2026-72320, CVE-2026-72322, CVE-2026-72323, CVE-2026-72329, CVE-2026-72339, CVE-2026-72348, CVE-2026-72351, CVE-2026-72355, CVE-2026-72366, CVE-2026-72381, CVE-2026-72393, CVE-2026-72398, CVE-2026-72399, CVE-2026-72412, CVE-2026-72417, CVE-2026-72422, CVE-2026-72429, CVE-2026-72436, CVE-2026-72442, CVE-2026-72451, CVE-2026-72463, CVE-2026-72466, CVE-2026-72472, CVE-2026-72473, CVE-2026-72477, CVE-2026-72491, CVE-2026-72493, CVE-2026-72494, CVE-2026-72495, CVE-2026-72496, CVE-2026-72501, CVE-2026-74255, CVE-2026-74267, CVE-2026-74268, CVE-2026-74269, CVE-2026-74287, CVE-2026-74310, CVE-2026-74345, CVE-2026-74350, CVE-2026-74361, CVE-2026-74376, CVE-2026-74384, CVE-2026-74394, CVE-2026-74398, CVE-2026-74401, CVE-2026-74406, CVE-2026-74427, CVE-2026-74428, CVE-2026-74433, CVE-2026-74434, CVE-2026-74436, CVE-2026-74439, CVE-2026-80665
Authoritative release date	2026-10-02 06:30:38.023709 UTC
Authority revision date	No separate material revision date is stated by Ubuntu; verified against the first-party notice API
Affected versions	The linux-gke source package on Ubuntu 26.04 LTS before the notice-listed build.
Fixed source build (not an install command)	Ubuntu 26.04 LTS: linux-gke 7.0.0-1007.8
CVSS base score	Not provided by the authority
CVSS severity	Not provided by the authority
Exploitation status	Not stated by the authority; no exploitation claim is inferred.

What Changed

The fixes span architecture code, storage and network drivers, filesystems and protocol handling. A CVE count is not a count of remotely reachable flaws on every node. Inventory the actual kernel, image and workload dependencies; this notice does not apply to a different node operating system merely because it runs in GKE.

Fixed Binary Packages

Canonical's notice API lists these visible binary fixes. Match installed packages; this is not an instruction to install every listed package.

• resolute: linux-image-7.0.0-1007-gke 7.0.0-1007.8; linux-image-7.0.0-1007-gke-64k 7.0.0-1007.8; linux-image-gke 7.0.0-1007.8; linux-image-gke-64k 7.0.0-1007.8; linux-image-gke-64k-7.0 7.0.0-1007.8; linux-image-gke-64k-hwe-26.04 7.0.0-1007.8; linux-image-gke-7.0 7.0.0-1007.8; linux-image-gke-hwe-26.04 7.0.0-1007.8.

What To Validate Now

1. Inventory. Locate Ubuntu 26.04 LTS GKE kernel deployments, versions, enabled features, exposure paths, owners, and dependent services.
2. Establish applicability. Match the installed Ubuntu release and binary packages to USN-8816-4. The source build identifies packaging provenance; it is not necessarily an installable package name. Do not transfer a version from another release or assume bundled upstream software is covered.
3. Remediate. For an administrator-managed Ubuntu host, update the matching binary kernel/metapackages from the supported security pocket and reboot, accounting for the ABI/module change. For provider-managed GKE nodes, use the supported node-pool/image upgrade process and confirm the fix with the provider; do not persist an ad hoc package change on a managed node as the fleet remedy.
4. Validate. Confirm the running kernel or replacement node image and required drivers, then check node readiness, networking, storage attachment and workload recovery. Review disruption budgets and spare capacity before the rollout. An installed package or healthy control plane alone does not prove every worker is updated.
5. Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.

Operational Cautions

Coordinate node replacement and service disruption using the GKE upgrade procedure where applicable. Keep the USN ABI/reboot requirement in scope for owned Ubuntu hosts. Do not force a drain or disable workload safeguards merely to make an upgrade complete.

Evidence To Retain

• Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
• UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
• Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.

Related TechGeeks Resources

• TechGeeks Security Notice Center
• All Security Notices

Authoritative References

• USN-8816-4

Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.