Does Cloud Run Gen 2 reporting uname -r = 6.9.12 include the fix or mitigation for CVE-2026-98432 in my region?

Google Cloud Serverless Applications
1

Cloud Run Gen 2 reports kernel 6.9.12 — patch status for CVE-2026-98432?

Hi there,

My Google Cloud Run service uses the second-generation execution environment, but uname -r still reports:

6.9.12

The container itself runs Alpine Linux 3.24.3. I understand that the container image determines the userspace distribution, while Google manages the underlying kernel.

I’m trying to establish whether the service is protected against CVE-2026-98432, which affects the Linux kernel’s IPv4 TCP networking code.

Google’s Container-Optimized OS release notes announce a fix on October 30, 2026, but I haven’t found confirmation specifically covering Cloud Run Gen 2.

Could someone from Google clarify:

  1. Has the fix or an effective mitigation been deployed to Cloud Run Gen 2 across all regions?

  2. Can a patched Cloud Run environment continue to report 6.9.12 because fixes are backported without changing the release string?

  3. Is there a supported way for customers to verify the kernel’s patch status beyond uname -r?

  4. Is any customer action required, such as redeploying the service, or is remediation handled entirely by Google?

I understand that the version string alone doesn’t establish vulnerability. I’m looking for an official confirmation of Cloud Run’s patch status and any required customer action.

Thanks!