USN-8914-1: critical flaw in Google Guest Agent on Ubuntu 22.04, patch available

Administrators running Ubuntu 22.04 LTS machines on Google Compute Engine have a package update to deploy. Canonical published security notice USN-8914-1 on 12 October 2026, addressing a vulnerability in the google-guest-agent and google-osconfig-agent packages. The notice affects only 22.04 LTS images (jammy); no other Ubuntu release is involved.

What's included

These two packages are not generic software: google-guest-agent is supplied by Google for installation in guest instances running on Google Compute Engine, and comprises a collection of tools and daemons that ensure Ubuntu images published on GCE function correctly on the platform. Those without VMs on GCP can disregard the notice: the packages are not installed elsewhere.

The issue originates upstream in the Go x/net/idna library, vendored within both agents. According to the advisory text, the package accepted labels encoded in Punycode that decode to ASCII-only labels when processing internationalized domain names, potentially allowing a remote attacker to bypass hostname-based access controls and escalate privileges. The associated CVE is CVE-2026-39821: according to the public CVE record, the flaw carries a CVSS score of 9.6 (critical), and the vulnerability in the x/net library was disclosed on 26 May 2026, with the upstream fix released in the same version.

Patched versions

Package	Fixed version (22.04 LTS)
google-guest-agent	20250116.00-0ubuntu1~22.04.4
google-osconfig-agent	20251028.00-0ubuntu2~22.04.1

How to update

A standard system upgrade applies the patch:

sudo apt update && sudo apt upgrade

To verify the installed version, use dpkg -l google-guest-agent google-osconfig-agent. For those remaining on 22.04 beyond the end of standard support, Canonical notes that Ubuntu Pro covers packages in Main and Universe for ten years and is free for up to 5 machines.