SKS Node Templates Updated to Mitigate CVE-2026-98432

All updated SKS node templates are now available to mitigate CVE-2026-98432, a critical Linux kernel vulnerability affecting IPv4 TCP connection handling.

To check whether your worker nodes are running an updated template, run kubectl get nodes.

Your nodes are not affected if every value in the VERSION column is one of the following:

• v1.34.13
• v1.35.10
• v1.36.6
• v1.37.2

Worker nodes managed through SKS NodePools that report any other version must be cycled to apply the updated template. If a NodePool is pinned to a specific template, select the corresponding updated template or switch the NodePool to Latest before cycling it.

Karpenter-managed nodes are cycled automatically within minutes after an updated template is published, provided Karpenter is allowed to replace them. This automatic replacement is enabled by default. After the rollout, run kubectl get nodes again to verify that every node is running one of the versions listed above.

Learn how to cycle SKS NodePools