Update: Actually under rare circumstances we&#x27;ll validate the checksum on the host side, realize it&#x27;s wrong, pass it to the guest as CHECKSUM_NEEDED and the guest will happily fail to checksum it and mark it as already validated. So, GCE&#x2F;GKE is not currently completely immune to this unfortunately :(<p>Practically speaking any traffic from the internet would not be affected as we require a valid checksum before doing the internet-&gt;guest NAT (see the GCE docs for what I mean here if this is unclear), but inter-VM traffic can potentially be impacted. On the other hand, inter-VM traffic has other verification applied to it that&#x27;s stronger than a TCP checksum. Basically: if you try to trigger this by sending bad packets you might succeed (although even there it&#x27;s not 100% guaranteed, but the details of what will&#x2F;won&#x27;t trigger it delve into implementation arcana that I&#x27;m not comfortable sharing).