Generic Kernel version-release: kernel-6.6.161.1-1

Certificate trust updates

Hardened certificate trust following the eMudhra incident (CVE-2026-114406). Removed or distrusted root certificates that could validate compromised eMudhra intermediate certificates, added intermediate-certificate rejection in Python and Go, and preserved SSL.com TLS trust where needed. Also refreshed Microsoft trusted root certificates.

Other changes

Add kubevirt-openvmm SPEC and GoldenCtr Dockerfiles
Add openvmm patch for confidential support
Backport ukify test fix for newer OpenSSL
Fix containerd2 to handle wrapped ENOTSUP during relabel
Fix dnf5 build failure with expat 2.9.0
Fix golden container tags to use build dates independently of base container versions
Fix grub2 Secure Boot metadata by raising SBAT to grub,6
Fix kernel to allow co-installation with kernel-hwe
Fix kernel to expose read-only Btrfs backing to IPE
Fix ptest failures in eight Python packages by pinning packaging to 23.2
Fix python-virtualenv security backports and development test reconciliation
Fix python-virtualenv test bootstrap while preserving RPM-owned packaging
Fix systemd: backport sd-event fix for hang after ratelimit expiry
Patch alsa-lib for CVE-2026-90781, CVE-2026-96674, CVE-2026-96675
Patch application-gateway-kubernetes-ingress for CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-97032
Patch aspell for CVE-2026-103658, CVE-2026-75818, CVE-2026-75819, CVE-2026-75820
Patch avahi for CVE-2024-52615
Patch azcopy for CVE-2026-78660, CVE-2026-78669
Patch binutils for CVE-2026-91781
Patch bluez for CVE-2026-19774
Patch busybox for CVE-2026-88835
Patch cert-manager for CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-81870, CVE-2026-92543, CVE-2026-97032
Patch cf-cli for CVE-2026-78660, CVE-2026-78669
Patch cloud-provider-kubevirt for CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-97032
Patch conda for CVE-2026-53940
Patch containerized-data-importer for CVE-2026-61801, CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-97032
Patch coredns for CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-82399, CVE-2026-86003, CVE-2026-97032
Patch cri-tools for CVE-2026-78660, CVE-2026-78669, CVE-2026-84304, CVE-2026-84445
Patch cups for CVE-2026-87875
Patch curl for CVE-2026-13608, CVE-2026-18924, CVE-2026-19931, CVE-2026-80230
Patch docker-buildx for CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-81870, CVE-2026-84304, CVE-2026-84445, CVE-2026-92543, CVE-2026-97032
Patch docker-cli for CVE-2026-78669, CVE-2026-92543
Patch docker-compose for CVE-2026-61801, CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-81870, CVE-2026-84304, CVE-2026-84445, CVE-2026-92543, CVE-2026-97032
Patch edk2 for CVE-2026-35189, CVE-2026-54872, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782
Patch emacs for CVE-2026-96269, CVE-2026-96442
Patch erlang for CVE-2026-105236, CVE-2026-65634, CVE-2026-68956, CVE-2026-89422, CVE-2026-94200
Patch flannel for CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-81870, CVE-2026-84304, CVE-2026-84445, CVE-2026-97032
Patch fluent-bit for CVE-2026-61674
Patch freetype for CVE-2026-95512
Patch git-lfs for CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-97032
Patch glib-networking for CVE-2026-103963
Patch gnuplot for CVE-2025-31176, CVE-2025-31180, CVE-2025-31181
Patch guava for CVE-2026-102554
Patch haproxy for CVE-2026-110354
Patch hdf5 for CVE-2025-2308, CVE-2025-2309, CVE-2026-106547, CVE-2026-19025, CVE-2026-19026
Patch ignition-flatcar for CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-97032
Patch influxdb for CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-82458, CVE-2026-97032
Patch iperf3 for CVE-2026-102253
Patch javapackages-bootstrap for CVE-2026-71497
Patch jx for CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-97032
Patch kata-containers for CVE-2026-107324, CVE-2026-107325, CVE-2026-61801, CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-81870, CVE-2026-97032
Patch kata-containers-cc for CVE-2026-107324, CVE-2026-42784, CVE-2026-63772, CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-81870, CVE-2026-93599, CVE-2026-93600, CVE-2026-93601, CVE-2026-93602, CVE-2026-94637, CVE-2026-97032
Patch krb5 for CVE-2026-107778
Patch kube-vip-cloud-provider for CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-81870, CVE-2026-97032
Patch kubernetes for CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-97032
Patch kubevirt for CVE-2026-107324, CVE-2026-107325, CVE-2026-61801, CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-84304, CVE-2026-84445, CVE-2026-93450, CVE-2026-97032
Patch kured for CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-97032
Patch libical for CVE-2026-111269, CVE-2026-88383
Patch libnfs for CVE-2026-108985
Patch libreswan for CVE-2026-77207, CVE-2026-94453
Patch librsvg2 for CVE-2026-96889
Patch libsndfile for CVE-2025-52194, CVE-2026-88386
Patch libsoup for CVE-2026-102555, CVE-2026-102556, CVE-2026-102557, CVE-2026-102558, CVE-2026-102560, CVE-2026-77014, CVE-2026-85197
Patch libvirt for CVE-2026-77159
Patch moby-containerd-cc for CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-81870, CVE-2026-84304, CVE-2026-84445, CVE-2026-97032
Patch moby-engine for CVE-2026-37236, CVE-2026-56855, CVE-2026-78662, CVE-2026-84304, CVE-2026-84445
Patch multus for CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-97032
Patch nfs-utils for CVE-2026-89098
Patch nmap for CVE-2026-89157, CVE-2026-89160
Patch ntopng for CVE-2026-38968
Patch opa for CVE-2026-78659, CVE-2026-97032
Patch opensc for CVE-2026-103531
Patch openssl for CVE-2026-35189, CVE-2026-42772, CVE-2026-54872, CVE-2026-54873, CVE-2026-54875, CVE-2026-72897, CVE-2026-75804, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782, CVE-2026-84784
Patch packer for CVE-2026-107324, CVE-2026-107325, CVE-2026-19585, CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-97032
Patch perl for CVE-2026-82560
Patch popt for CVE-2026-18743
Patch prometheus-adapter for CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-97032
Patch prometheus-node-exporter for CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-97032
Patch prometheus-process-exporter for CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-97032
Patch python-oauthlib for CVE-2026-49264, CVE-2026-49265
Patch python-twisted for CVE-2026-106454
Patch python-urllib3 for CVE-2026-97689
Patch python-virtualenv for CVE-2026-102925, CVE-2026-102930
Patch qemu for CVE-2026-81627, CVE-2026-93834
Patch qtbase for CVE-2026-78253
Patch qtdeclarative for CVE-2026-79616
Patch rabbitmq-server for CVE-2026-43969, CVE-2026-66071, CVE-2026-66076, CVE-2026-67223, CVE-2026-67224, CVE-2026-67227, CVE-2026-67230, CVE-2026-67231, CVE-2026-67404, CVE-2026-67409, CVE-2026-67411, CVE-2026-67412, CVE-2026-67418, CVE-2026-67419, CVE-2026-67420, CVE-2026-67421
Patch rsync for CVE-2026-18743
Patch runc for CVE-2026-61801
Patch skopeo for CVE-2026-107324, CVE-2026-107325, CVE-2026-61801, CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-97032
Patch sos for CVE-2026-79655
Patch squid for CVE-2026-61642
Patch sriov-network-device-plugin for CVE-2026-78660, CVE-2026-78669
Patch sudo for CVE-2026-96512
Patch tar for CVE-2026-5704
Patch telegraf for CVE-2026-107324, CVE-2026-107325, CVE-2026-61801, CVE-2026-63772, CVE-2026-66055, CVE-2026-77403, CVE-2026-77405, CVE-2026-77406, CVE-2026-77407, CVE-2026-77408, CVE-2026-77409, CVE-2026-77410, CVE-2026-77411, CVE-2026-77412, CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-82458, CVE-2026-83663, CVE-2026-94637, CVE-2026-97032
Patch util-linux for CVE-2026-53612, CVE-2026-53613, CVE-2026-53614, CVE-2026-53615
Patch vitess for CVE-2026-104252, CVE-2026-63772, CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-94637, CVE-2026-97032
Patch zlib for CVE-2026-76844
Remove KEDA from Azure Linux
Upgrade afflib to 3.7.23 for CVE-2026-119601
Upgrade azurelinux-image-tools to v1.7.0 for CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-97032
Upgrade bind to 9.20.30 for CVE-2026-94300
Upgrade brotli to 1.2.1-1 for Broccoli2Shell CVE-2026-111497
Upgrade c-ares to 1.34.8 for CVE-2026-69184, CVE-2026-69186
Upgrade cifs-utils to 7.9 for CVE-2026-104715
Upgrade conta...

Generic Kernel version-release: kernel-6.6.157.1-1

Add standalone keysinuse package
Fix dasel ptest failure with Go 1.27 (reflect.TypeFor / go.mod language version)
Fix python-markdown html.parser incompatibility with Python 3.12.14
Fix segfault in iperf caused by CVE-2026-71218
Fix toolkit encrypted ISO installer hang
Patch azcopy for CVE-2026-84445, CVE-2026-83530
Patch azurelinux-image-tools for CVE-2026-84445, CVE-2026-83530
Patch ceph for CVE-2026-54330
Patch cert-manager for CVE-2026-84445, CVE-2026-83530, CVE-2026-78662, CVE-2026-56855, CVE-2026-37236
Patch cf-cli for CVE-2026-78662, CVE-2026-56855, CVE-2026-37236
Patch cloud-provider-kubevirt for CVE-2026-84445, CVE-2026-84304, CVE-2026-83530, CVE-2026-37236
Patch containerized-data-importer for CVE-2026-84445, CVE-2026-84304 by upgrading grpc vendor module
Patch coredns for CVE-2026-84445, CVE-2026-84304
Patch cri-tools for CVE-2026-37236
Patch docker-buildx for CVE-2026-78662, CVE-2026-56855, CVE-2026-37236
Patch docker-compose for CVE-2026-78662, CVE-2026-56855, CVE-2026-37236
Patch elixir for CVE-2026-75758
Patch flannel for CVE-2026-37236
Patch fluent-bit for CVE-2026-33630
Patch gdk-pixbuf2 for CVE-2026-81893
Patch grpc for GHSA-hf3w-6hpw-qp67
Patch kata-containers for CVE-2026-84445, CVE-2026-84304 by upgrading grpc vendor module
Patch kata-containers-cc for CVE-2026-84445, CVE-2026-84304 by upgrading grpc vendor module
Patch keda for CVE-2026-37236
Patch kube-vip-cloud-provider for CVE-2026-84445, CVE-2026-84304, CVE-2026-83530, CVE-2026-37236
Patch kubernetes for CVE-2026-78662, CVE-2026-56855, CVE-2026-37236
Patch kubevirt for CVE-2026-78662, CVE-2026-56855
Patch libreswan for CVE-2026-14957
Patch libtpms for CVE-2026-85769
Patch libxml2 for CVE-2026-86144, CVE-2026-86143, CVE-2026-86142, CVE-2026-86140, CVE-2026-86138, CVE-2026-86137, CVE-2026-74860
Patch moby-containerd-cc for CVE-2026-37236
Patch ntfs-3g for CVE-2026-42616, CVE-2026-42618, CVE-2026-46569, CVE-2026-46570, CVE-2026-46571
Patch packer for CVE-2026-78662, CVE-2026-56855
Patch perl-URI for CVE-2026-19953
Patch prometheus-adapter for CVE-2026-37236
Patch python3 for CVE-2026-15806, CVE-2026-19672
Patch qtbase for CVE-2026-11573
Patch rsyslog for CVE-2026-78002
Patch ruby for CVE-2026-82455
Patch rust for CVE-2026-58050, CVE-2026-58051, CVE-2026-66033, CVE-2026-66034, CVE-2026-82251, CVE-2026-82253, CVE-2026-7598, CVE-2026-82252
Patch skopeo for CVE-2026-84445, CVE-2026-84304 by upgrading grpc vendor module
Patch sriov-network-device-plugin for CVE-2026-84445, CVE-2026-83530
Patch strongswan for CVE-2026-78135, CVE-2026-78134, CVE-2026-78132, CVE-2026-78131, CVE-2026-78130, CVE-2026-78129, CVE-2026-78127, CVE-2026-78126, CVE-2026-78124, CVE-2026-78123
Patch telegraf for CVE-2026-84445, CVE-2026-84304, CVE-2026-83530, CVE-2026-78662, CVE-2026-56855, CVE-2026-37236
Patch util-linux for CVE-2026-78410, CVE-2026-78408, CVE-2026-76642
Patch vitess for CVE-2026-84445, CVE-2026-83530
Remove toolkit unused partition reread helpers
Upgrade HWE kernel to version 6.18.48.1
Upgrade SymCrypt-OpenSSL to 1.10.2
Upgrade ant to 1.10.18 for CVE-2026-78254
Upgrade ant-junit to 1.10.18 to match sibling ant SPEC
Upgrade bubblewrap to 0.12.0 for CVE-2026-87766
Upgrade containerd2 to 2.3.4 and runc to 1.4.3 for CVE-2026-37236
Upgrade gh to 2.101.0 for CVE-2026-84445, CVE-2026-84304, CVE-2026-56855, CVE-2026-78662, CVE-2026-72924
Upgrade kata-containers to 4.1.0.kata0
Upgrade libXfont2 to 2.0.9 for CVE-2026-59679, CVE-2026-44950
Upgrade nginx to v1.30.4 and ngs to v1.0.1 for CVE-2026-78669, CVE-2026-78222, CVE-2026-18329
Upgrade nodejs to 24.21.0 for CVE-2026-18149, CVE-2026-18540
Upgrade pcre2 to 10.48 for CVE-2026-89156, CVE-2026-89157, CVE-2026-86145, CVE-2026-89158, CVE-2026-89160, CVE-2026-89162
Upgrade shim to 16.1 w/ dual signatures
Upgrade unbound to 1.26.1 for CVE-2026-77860, CVE-2026-77955, CVE-2026-78227, CVE-2026-80225, CVE-2026-81634, CVE-2026-81642, CVE-2026-82717, CVE-2026-82720, CVE-2026-85501
imageconfig: marketplace-gen2-kernel-mshv: pin shim to 15.8

Generic Kernel version-release: kernel-6.6.150.1-1

Add Kubevirt sidecar-shim sub-package and golden container image
Add openvmm to SPECS/SPECS-EXTENDED
Fix atftp ptest
Fix containerd2
Fix glibc ptest
Fix kata-containers-cc
Fix libgit2 ptest
Fix memcached authentication token and binary protocol crash fixes
Fix openssl backport EVP_PKEY_Q_keygen support
Fix pango ptest
Fix poetry ptest
Fix rasdaemon
Fix tracelogging ptest
Patch apr-util for CVE-2026-32327, CVE-2026-34502, CVE-2026-34501, CVE-2025-49506
Patch bison for CVE-2026-56389, CVE-2026-56390
Patch bluez for CVE-2026-75032
Patch cert-manager for CVE-2026-73500
Patch cloud-provider-kubevirt for CVE-2026-73500
Patch cpio for CVE-2026-66486, CVE-2026-66485, CVE-2026-66484
Patch docker-cli for CVE-2026-17106
Patch edk2 for CVE-2026-75803, CVE-2026-63076, CVE-2026-63074, CVE-2026-63072, CVE-2026-42770
Patch emacs for CVE-2026-79992, CVE-2026-77219
Patch erlang for CVE-2026-75538, CVE-2026-74994, CVE-2026-74835, CVE-2026-73812, CVE-2026-73276, CVE-2026-73270, CVE-2026-71380, CVE-2026-70399, CVE-2026-69664, CVE-2026-66357, CVE-2026-55951, CVE-2026-53422, CVE-2026-54887, CVE-2026-55950, CVE-2026-59250
Patch expat for CVE-2026-76957, CVE-2026-76956, CVE-2026-76641, CVE-2026-66046
Patch flannel for CVE-2026-73500
Patch gawk for CVE-2026-40553, CVE-2026-40468, CVE-2026-40467
Patch gdb for CVE-2026-15003
Patch influxdb for CVE-2026-55969, CVE-2026-48586, CVE-2026-43871
Patch iperf3 for CVE-2026-71218, CVE-2026-71217
Patch kata-containers for CVE-2026-50540, CVE-2026-77176
Patch kata-containers-cc for CVE-2026-55969, CVE-2026-48586, CVE-2026-43871, CVE-2026-50540, CVE-2026-44210
Patch kbd for CVE-2026-72693
Patch keda for CVE-2026-79921, CVE-2026-73500
Patch keras for CVE-2026-12480
Patch kube-vip-cloud-provider for CVE-2026-73500
Patch kubernetes for CVE-2026-73500
Patch libgit2 for CVE-2026-53587, CVE-2026-53586, CVE-2026-53585, CVE-2026-53584, CVE-2026-53583
Patch libssh2 for CVE-2026-58051
Patch libvirt for CVE-2026-63623, CVE-2026-63622, CVE-2026-61477, CVE-2026-18917
Patch moby-engine for CVE-2026-61711, CVE-2026-61712, CVE-2026-75593, CVE-2026-17106
Patch mysql for CVE-2026-63388, CVE-2026-63387, CVE-2026-63385, CVE-2026-63384, CVE-2026-63383, CVE-2026-63382, CVE-2026-63381, CVE-2026-63379
Patch nmap for CVE-2026-72712
Patch nodejs for CVE-2026-15157
Patch ntfs-3g for CVE-2026-56136, CVE-2026-56135
Patch ntp for CVE-2026-63388, CVE-2026-63387, CVE-2026-63385, CVE-2026-63384, CVE-2026-63383, CVE-2026-63382, CVE-2026-63381, CVE-2026-63379
Patch openssh for CVE-2026-73283, CVE-2026-73282, CVE-2026-73281
Patch openssl for CVE-2026-75803, CVE-2026-63076, CVE-2026-63075, CVE-2026-63074, CVE-2026-63073, CVE-2026-63072, CVE-2026-54874
Patch packer for CVE-2026-19589, CVE-2026-71557, CVE-2026-71556
Patch perl for CVE-2026-15534, CVE-2026-19487
Patch prometheus-adapter for CVE-2026-73500, CVE-2026-33186
Patch python-cryptography for CVE-2026-69249
Patch python-lxml for CVE-2026-49825
Patch python-pip for CVE-2026-13346
Patch python-virtualenv for CVE-2026-13346
Patch pytorch for CVE-2026-63632
Patch rabbitmq-server for CVE-2026-65624, CVE-2026-59248, CVE-2026-43971
Patch rpm for CVE-2026-44605
Patch rsyslog for CVE-2026-19654
Patch ruby for CVE-2026-80213, CVE-2026-80212
Patch rust for CVE-2026-47143
Patch strongswan for CVE-2026-47895
Patch sudo for CVE-2026-82474
Patch swtpm for CVE-2026-75900
Patch systemd for CVE-2026-16742, CVE-2026-15059
Patch systemd-bootstrap for CVE-2026-15059
Patch telegraf for CVE-2026-79921, CVE-2026-54332
Patch vitess for CVE-2026-65959
Upgrade KubeVirt to 1.8.4, LibVirt to 11.9.0 and QEMU to 10.1.0
Upgrade ca-certificates Msft cert change (Picks up missing Go-Daddy Cert)
Upgrade clamav to 1.5.4 for CVE-2026-20348, CVE-2026-20347, CVE-2026-20346, CVE-2026-20345, CVE-2026-20339, CVE-2026-20338, CVE-2026-20337
Upgrade cloud-hypervisor to 52.0.152
Upgrade expat to 2.8.3 for CVE-2026-72522
Upgrade freeipmi to 1.6.19 for CVE-2026-85504, CVE-2026-85508, CVE-2026-85505, CVE-2026-85509, CVE-2026-85506, CVE-2026-85507
Upgrade gh to 2.98.0 for CVE-2026-72924
Upgrade golang to 1.26.7-1 (Previous Tip Version)
Upgrade golang to 1.27.1-2 (New Tip Version)
Upgrade libevent to 2.1.13 for CVE-2026-63388, CVE-2026-63381, CVE-2026-63387, CVE-2026-63385, CVE-2026-63382, CVE-2026-63379, CVE-2026-63383, CVE-2026-63384
Upgrade libgcrypt to 1.11.3
Upgrade libgpg-error to 1.49
Upgrade libkcapi to 1.5.1 for CVE-2026-71225, CVE-2026-71226, CVE-2026-71227
Upgrade libpcap to 1.10.7 for CVE-2026-18238, CVE-2026-31911, CVE-2026-18313, CVE-2026-6244, CVE-2026-31912, CVE-2026-0799, CVE-2026-6554
Upgrade mariadb to 10.11.19
Upgrade nodejs to 24.20.0
Upgrade p11-kit to 0.26.5 for CVE-2026-18938, CVE-2026-13757
Upgrade perl-DBI to 1.652 for CVE-2026-73193, CVE-2026-73194
Upgrade perl-HTTP-Date to 6.08 for CVE-2026-14741
Upgrade postgresql to 16.15 for CVE-2026-6464, CVE-2026-6469, CVE-2026-6470, CVE-2026-6471, CVE-2026-14662, CVE-2026-14663, CVE-2026-14664, CVE-2026-14666, CVE-2026-14668, CVE-2026-14669, CVE-2026-14670, CVE-2026-14671, CVE-2026-14672, CVE-2026-14673, CVE-2026-14676, CVE-2026-14677, CVE-2026-14678, CVE-2026-14679, CVE-2026-14680, CVE-2026-14681, CVE-2026-15741, CVE-2026-15742, CVE-2026-16238, CVE-2026-16239, CVE-2026-16241, CVE-2026-18024, CVE-2026-18408, CVE-2026-19385
Upgrade python-mistune to 3.3.4 for CVE-2026-76098
Upgrade python-webob to 1.8.11 for CVE-2026-54770
Upgrade python3 to 3.12.14 for CVE-2026-18503, CVE-2026-15308, CVE-2026-7210, CVE-2026-4224
Upgrade rsync to 3.5.0 for 33 CVEs
Upgrade rubygem-msgpack to 1.8.4 for CVE-2026-54522
Upgrade rust to 1.96.1
Upgrade shim to 16.1
Upgrade trident to 0.28.0
Upgrade tzdata to 2026c (Includes new British Columbia Time Zone change)
Upgrade unbound to 1.26.0
Upgrade valkey to 8.0.11 for CVE-2026-82631
Upgrade vim to 9.2.0976 for CVE-2026-73078, CVE-2026-73074, CVE-2026-73072, CVE-2026-73077, CVE-2026-73076, CVE-2026-73070, CVE-2026-73075, CVE-2026-73071 CVE-2026-73073
Enable CONFIG_PCI_P2PDMA, CONFIG_VFIO_PCI_DMABUF, CONFIG_IOMMUFD and CONFIG_IOMMUFD_VFIO_CONTAINER to support GPU pass-thru on arm64
e2fsprogs: backport fix for e2fsck skipping checks with orphan_file
imageconfig: marketplace-gen2-kernel-mshv: install nested virt packages
Toolkit: ImageGen tooling rebased from parted to sfdisk. Updated minimum Golang version to 1.25

Generic Kernel version-release: kernel-6.6.150.1-1

Upgrade ca-certificates Msft cert change
bcc: Backport profile tool from upstream
feat(kernel-hwe): Enable vmxnet3
feat(kernel): enable fscrypt configs for kernel and kernel-ipe
Fix container-publishing fixes via cherry-pick #18033 + #18034 to 3.0-dev
Fix golang version cap for nvidia container runtime
Fix ISO attendedinstaller to consume Disks section from attendedconfig.json
Fix ptest failures for multiple packages
Fix workflow permissions for 19 check/lint/quickstart workflows
golang: bump Go version to 1.25.12-1
Kernel upgrade to version 6.6.150.1
Merge PR Upgrade perl-DBI to 1.651 for CVE-2026-14380, CVE-2026-14739 & CVE-2026-14740
Patch application-gateway-kubernetes-ingress for CVE-2026-56852
Patch azcopy for CVE-2026-56852
Patch azurelinux-image-tools for CVE-2026-56852
Patch busybox for CVE-2026-38753, CVE-2026-38752, CVE-2026-38755, CVE-2026-38754
Patch cert-manager for CVE-2026-56852, CVE-2026-63308
Patch cf-cli for CVE-2026-56852
Patch cloud-provider-kubevirt for CVE-2026-56852
Patch containerd2 for CVE-2026-56852
Patch containerized-data-importer for CVE-2026-56852
Patch coredns for CVE-2026-56852
Patch coredns for CVE-2026-62299
Patch coredns for CVE-2026-62994
Patch coreutils for CVE-2025-5278
Patch cri-tools for CVE-2026-56852
Patch curl for CVE-2026-8932, CVE-2026-8927, CVE-2026-8926, CVE-2026-12064, CVE-2026-8458, CVE-2026-9079, CVE-2026-8286, CVE-2026-10536, CVE-2026-11856
Patch dcos-cli for CVE-2026-56852
Patch docker-buildx for CVE-2026-56852
Patch docker-cli for CVE-2026-56852
Patch docker-compose for CVE-2026-56852
Patch erlang for CVE-2026-54886
Patch erlang for CVE-2026-59251, CVE-2026-58227, CVE-2026-55953, CVE-2026-55737, CVE-2026-42792
Patch flannel for CVE-2026-56852
Patch gh for CVE-2026-59831
Patch git-lfs for CVE-2026-56852
Patch glib for CVE-2026-58016, CVE-2026-58015, CVE-2026-58014, CVE-2026-58013, CVE-2026-58012, CVE-2026-58011, CVE-2026-58010, CVE-2026-15588
Patch haproxy for CVE-2026-26081
Patch hdf5 for CVE-2025-44904
Patch hdf5 for CVE-2026-26199, CVE-2026-26197, CVE-2026-17574, CVE-2026-17573, CVE-2026-17572
Patch ignition-flatcar for CVE-2026-56852
Patch influxdb for CVE-2026-56852
Patch isns-utils for CVE-2026-55995
Patch jx for CVE-2026-56852
Patch kata-containers for CVE-2026-56852
Patch kata-containers-cc for CVE-2026-56852
Patch keda for CVE-2026-56852
Patch kube-vip-cloud-provider for CVE-2026-56852
Patch kubernetes for CVE-2024-7598
Patch kubernetes for CVE-2026-56852
Patch kubevirt for CVE-2026-56852
Patch kured for CVE-2026-56852
Patch libarchive for CVE-2026-14164
Patch libreswan for CVE-2026-50722, CVE-2026-50721, CVE-2026-12413
Patch libsndfile for CVE-2026-37555
Patch libsolv for CVE-2026-48863
Patch libssh for CVE-2026-59850, CVE-2026-59847, CVE-2026-59845, CVE-2026-59844, CVE-2026-59843, CVE-2026-59848
Patch libssh2 for CVE-2026-66035, CVE-2026-66034, CVE-2026-66033, CVE-2026-66032
Patch libtiff for CVE-2026-12912
Patch moby-containerd-cc for CVE-2026-46680, CVE-2026-53488, CVE-2026-56852
Patch moby-engine for CVE-2026-56852
Patch mtr for CVE-2026-14461
Patch multus for CVE-2026-56852
Patch nginx for CVE-2026-42055, CVE-2026-56434, CVE-2026-42533
Patch nodejs for CVE-2026-12151, CVE-2026-9679, CVE-2026-11525
Patch opa for CVE-2026-56852
Patch open-vm-tools for CVE-2025-41244
Patch openssh for CVE-2026-60002, CVE-2026-60001, CVE-2026-60000, CVE-2026-59999, CVE-2026-59997, CVE-2026-59996, CVE-2026-59995
Patch openssl for CVE-2026-45447, CVE-2026-42769, CVE-2026-42770
Patch packer for CVE-2026-56852, CVE-2026-45570, CVE-2026-45571
Patch patch for CVE-2026-56289, CVE-2026-56288
Patch perl for CVE-2026-57432, CVE-2026-13221, CVE-2026-57433
Patch perl-HTTP-Daemon for CVE-2026-8450
Patch prometheus-adapter for CVE-2026-56852
Patch prometheus-node-exporter for CVE-2026-56852
Patch prometheus-process-exporter for CVE-2026-56852
Patch python-msgpack for CVE-2026-57585
Patch python-pyasn1 for CVE-2026-59884, CVE-2026-59885, CVE-2026-59886
Patch python-setuptools for CVE-2026-59890
Patch python3 for CVE-2026-9669, CVE-2026-6879, CVE-2026-6100, CVE-2026-4786, CVE-2026-4360, CVE-2026-3644, CVE-2026-3276, CVE-2026-3087, CVE-2026-2297, CVE-2026-12003, CVE-2026-11972, CVE-2026-0864
Patch pytorch for CVE-2026-14647
Patch qemu for CVE-2026-3842
Patch qtbase for CVE-2026-15037
Patch rabbitmq-server for CVE-2026-43966, CVE-2026-44839, 11 CVE-2026-572xx
Patch rest for CVE-2026-16615
Patch rubygem-excon for CVE-2026-54171
Patch rust for CVE-2026-47143
Patch skopeo for CVE-2026-56852
Patch squid for CVE-2026-50012, CVE-2026-47729
Patch sriov-network-device-plugin for CVE-2026-56852
Patch telegraf for CVE-2026-56852, CVE-2026-58253, CVE-2026-58252, CVE-2026-58251, CVE-2026-58250, CVE-2026-58209, CVE-2026-58208, CVE-2026-58207, CVE-2026-54908, CVE-2025-29923, CVE-2025-46327
Patch vitess for CVE-2026-56852, CVE-2026-55969, CVE-2026-43871
Upgrade azurelinux-image-tools to version v1.6.0
Upgrade bind to 9.20.26 for CVE-2026-11331, CVE-2026-11721, CVE-2026-13321, CVE-2026-10723, CVE-2026-12617, CVE-2026-10822, CVE-2026-11605, CVE-2026-11622
Upgrade cifs-utils to 7.7 for CVE-2026-12505
Upgrade clamav to 1.5.3 for CVE-2026-20213, CVE-2026-20214, CVE-2026-20215, CVE-2026-20216, CVE-2026-20217, CVE-2026-20243, CVE-2026-20244, CVE-2026-14191
Upgrade etcd to 3.5.33 for CVE-2026-56852, CVE-2026-59818
Upgrade fwupd to v2.0.20 and promote to SPECS
Upgrade golang to 1.26.5-2
Upgrade iscsi-initiator-utils to version 2.1.12 for CVE-2026-44943, CVE-2026-44944
Upgrade kata-containers to 3.32.kata0
Upgrade kernel to version 6.18.38.2
Upgrade libXfont2 to 2.0.8 for CVE-2026-56001, CVE-2026-56002, CVE-2026-56003
Upgrade nodejs to 24.18.1 for CVE-2026-56846, CVE-2026-56848, CVE-2026-58043, CVE-2026-56850, CVE-2026-58040, CVE-2026-58041, CVE-2026-58042, CVE-2026-58045, CVE-2026-56847, CVE-2026-58039, CVE-2026-58044
Upgrade perl-DBI to 1.651 for CVE-2026-14380, CVE-2026-14739, CVE-2026-14740
Upgrade PHP to 8.3.33 for CVE-2026-12184, CVE-2026-14355
Upgrade python-jwt to 2.13.0 for CVE-2026-32597, CVE-2026-48526, CVE-2026-48522, CVE-2026-48525, CVE-2026-48524
Upgrade rpcbind to 1.2.9 for CVE-2026-16277
Upgrade shim to v16.1 w/ dual signatures
Upgrade SymCrypt-OpenSSL to 1.10 with ML-KEM support
Upgrade thrift to 0.24.0 for CVE-2026-48144, CVE-2026-49158, CVE-2026-58023, CVE-2026-58662, CVE-2026-66053, CVE-2026-55970, CVE-2026-41608, CVE-2026-55969, CVE-2026-43871, CVE-2026-48586, CVE-2026-48145, CVE-2026-55971, CVE-2026-41606, CVE-2026-41607
Upgrade trident to 0.26.0
Upgrade unbound to 1.25.2 (24 CVEs)
Upgrade valkey to 8.0.10 for CVE-2026-56684, CVE-2026-63639
Upgrade vim to 9.2.0782 for CVE-2026-59856
Upgrade xorg-x11-server-Xwayland to 24.1.13 for CVE-2026-55999, CVE-2026-56000

Generic Kernel version-release: kernel-6.6.143.1-1

Add argparse-manpage to SPECS-EXTENDED
Add Koji message-bus packages to SPECS-EXTENDED
Add nftables patch to fix segfault when listing ruleset containing user-data (udata) in rule expressions
Add ukify-fix-insertion-of-padding-in-merged-sections patch to systemd
Fix failing core ptest in systemd and libguestfs
Fix gd ptest issue
Fix krb5 Backport upstream SPNEPO mechListMIC parsing fix (ticket 9183)
Fix libstoragemgmt: Address ptest and package installation failure
Fix openmpi runtime dependencies
Fix openmpi subpackages
Fix openmpi Restore openmpi-devel subpackages
Fix ptest failure in rng-tools
Fix ptest failures in perl-IO-Socket-SSL package
Fix ptest failures in python-beautifulsoup4 package
Fix ptest failures in python-zope-interface package
Fix ptest for gperftools
Fix ptest for python-omegaconf
Fix ptests failure in openvswitch package
Fix ptests failure in runc package
Fix ptests failure in subversion package
Fix selinux-policy to allow container engines to mmap runtime files
Fix selinux-policy to update policy for irqbalance v1.9.5
Fix waagent-network-setup.service failure and update to teardown the specific interface
freeradius: move from specs-extended to specs
libssh2: patch CVE-2026-55200 (OOB write in transport read)
Merge PR Patch perl for CVE-2026-48962, CVE-2026-48959, CVE-2026-42496, CVE-2025-15649
Merge PR Patch perl-DBI for CVE-2026-10879
mlnx-ofa_kernel-hwe-modules-signed: drop fwctl.ko (broken since DOCA 3.3.0 bump)
Patch bzip2 for CVE-2026-42250
Patch cf-cli for CVE-2026-42502, CVE-2026-39835, CVE-2026-39828, CVE-2026-39827, CVE-2026-25681, CVE-2026-25680
Patch cloud-provider-kubevirt for CVE-2026-42502, CVE-2026-25681, CVE-2026-25680
Patch cmake for CVE-2026-4873, CVE-2026-6276, CVE-2026-6253, CVE-2026-6429, CVE-2026-5545
Patch cni-plugins for CVE-2026-42506, CVE-2026-27136, CVE-2026-42502, CVE-2026-25681, CVE-2026-25680
Patch containerd2 for CVE-2026-42502, CVE-2026-25681, CVE-2026-25680
Patch crash for CVE-2025-11083
Patch curl for CVE-2026-6253, CVE-2026-6429, CVE-2026-5545
Patch dasel for CVE-2026-42506, CVE-2026-27136, CVE-2026-25680, CVE-2026-42502, CVE-2026-25681
Patch dhcpcd for CVE-2026-14258, CVE-2026-56113, CVE-2026-56117, CVE-2026-56116, CVE-2026-56114
Patch docker-buildx for CVE-2026-39833, CVE-2026-46598, CVE-2026-42502, CVE-2026-39835, CVE-2026-39827, CVE-2026-25681, CVE-2026-25680
Patch docker-compose for CVE-2026-46598, CVE-2026-42502, CVE-2026-39835, CVE-2026-39827, CVE-2026-25681, CVE-2026-25680
Patch edk2 for CVE-2026-9076, CVE-2026-7383, CVE-2026-45447, CVE-2026-45445, CVE-2026-42767, CVE-2026-42766, CVE-2026-34182, CVE-2026-34180
Patch elixir for CVE-2026-49762
Patch gdb for CVE-2025-11083
Patch gh for CVE-2026-42502, CVE-2026-39835, CVE-2026-39828, CVE-2026-39827, CVE-2026-25681, CVE-2026-25680
Patch gh for CVE-2026-45803
Patch glib for CVE-2026-0988
Patch glib-networking for CVE-2026-10028
Patch gnupg2 for CVE-2026-57062
Patch golang & golang-1.25 for CVE-2026-39821
Patch gzip for CVE-2026-41992
Patch haproxy for CVE-2026-55204, CVE-2026-55203
Patch jq for CVE-2026-49839, CVE-2026-47770, CVE-2025-9403
Patch kata-containers for CVE-2025-58160 and CVE-2026-27171
Patch kata-containers-cc for CVE-2025-5791 and CVE-2025-4574, CVE-2026-42250
Patch keda for CVE-2026-41889, CVE-2026-42502, CVE-2026-25681, CVE-2026-25680
Patch ldns for CVE-2026-10846
Patch libinput for CVE-2026-50292
Patch libnfs for CVE-2026-53689
Patch libsolv for CVE-2026-9150, CVE-2026-9149
Patch libsoup for CVE-2026-2708, CVE-2026-6324
Patch libssh2 for CVE-2026-55199, CVE-2025-15661
Patch libxml2 for CVE-2026-0989
Patch multus for CVE-2026-42502, CVE-2026-25681, CVE-2026-25680
Patch nginx for CVE-2026-49975, CVE-2026-48142
Patch nmap for CVE-2026-58058
Patch opensc for CVE-2026-10275
Patch openssh for CVE-2026-35387, CVE-2026-35414
Patch openssl for CVE-2026-34182, CVE-2026-9076, CVE-2026-7383, CVE-2026-45446, CVE-2026-45445, CVE-2026-42768, CVE-2026-42766, CVE-2026-34183, CVE-2026-34180, CVE-2026-42767
Patch opentelemetry-cpp for CVE-2026-44967
Patch packer for CVE-2026-39833, CVE-2026-45570, CVE-2026-45571
Patch perl for CVE-2026-48962, CVE-2026-48959, CVE-2026-42496, CVE-2025-15649, CVE-2026-12087, CVE-2026-8376
Patch perl-Bytes-Random-Secure for CVE-2026-11625
Patch perl-DBI for CVE-2026-10879, CVE-2026-9698
Patch perl-HTML-Parser for CVE-2026-8829
Patch poetry for CVE-2026-41140
Patch python-pip for CVE-2026-8643
Patch python-virtualenv for CVE-2026-8643
Patch python3 for CVE-2025-13462, CVE-2026-8328, CVE-2026-7774
Patch qemu for CVE-2026-3195, CVE-2026-3196, CVE-2026-48914
Patch rabbitmq-server for CVE-2026-43973
Patch rrdtool for CVE-2026-43958
Patch rust for CVE-2026-40034, CVE-2026-5222, CVE-2026-5223
Patch sqlite for CVE-2026-11822, CVE-2026-11824
Patch telegraf for CVE-2026-46598, CVE-2026-42502, CVE-2026-39835, CVE-2026-39828, CVE-2026-39827, CVE-2026-25681, CVE-2026-25680
Patch tmux for CVE-2026-11623
Patch util-linux for CVE-2026-13595
Prevent corruption from stale alias state on daemon-reload
refactor(openssl-fips-provider): Better align with openssl's fips provider
Upgrade acl to 2.4.0 for CVE-2026-54369, CVE-2026-54370, CVE-2026-54371
Upgrade alsa-lib to 1.2.16.1 for CVE-2026-56109
Upgrade attr to 2.6.0 for CVE-2026-54369, CVE-2026-54370, CVE-2026-54371
Upgrade azurelinux-image-tools to v1.5.0
Upgrade cloud-hypervisor to 51.1.101
Upgrade dnsmasq to 2.93 for CVE-2026-12969, CVE-2026-12725
Upgrade doca to 3.3.0
Upgrade erlang to 26.2.5.21 for CVE-2026-42789, CVE-2026-42790, CVE-2026-49760, CVE-2026-49759, CVE-2026-48860, CVE-2026-48858, CVE-2026-48856, CVE-2026-48855
Upgrade expat to 2.8.2 for multiple CVEs
Upgrade freeipmi to 1.6.18 for CVE-2026-50031
Upgrade gnutls to 3.8.13 for CVE-2026-42012, CVE-2026-42013, CVE-2026-5260
Upgrade golang to 1.25.11-1
Upgrade golang to 1.26.4-1
Upgrade httpd to 2.4.68 for CVE-2026-49975
Upgrade icu component version for package nodejs
Upgrade kernel-hwe to 6.18.36.1 and doca to 3.3.0 (first version with 6.18 series kernel)
Upgrade kernel to version 6.6.143.1
Upgrade kernel-mshv to 6.6.137.mshv2
Upgrade libslirp to 4.9.3 for CVE-2026-9539
Upgrade libusb to 1.0.30 for CVE-2026-23679, CVE-2026-47104
Upgrade libXpm to 3.5.19 for CVE-2026-4367
Upgrade lldpd to 1.0.22 for CVE-2026-46433
Upgrade mock to 6.7 and add dependent package argparse-manpage version 4.7
Upgrade nodejs to 24.17.0 for multiple CVEs
Upgrade openssl to 3.3.7
Upgrade openvswitch to 3.3.9
Upgrade postfix to 3.9.11 for CVE-2026-43964
Upgrade python-mistune to 3.3.0 for CVE-2026-49851
Upgrade python-webob to 1.8.10 for CVE-2026-44889
Upgrade radvd to 2.21 for CVE-2026-48715
Upgrade rubygem-concurrent-ruby to 1.3.7 for CVE-2026-54904, CVE-2026-54905, CVE-2026-54906
Upgrade rubygem-nokogiri to 1.19.4 for CVE-2026-57438, CVE-2026-57435, CVE-2026-57236, CVE-2026-57437, CVE-2026-57434, CVE-2026-57436, CVE-2026-57234, CVE-2026-57235
Upgrade runc to 1.3.6 for CVE-2026-41579
Upgrade trident to 0.24.0
Upgrade vim to 9.2.0735 for CVE-2026-52858, CVE-2026-52859, CVE-2026-52860, CVE-2026-47162, CVE-2026-47167, CVE-2026-57452, CVE-2026-57455, CVE-2026-55895, CVE-2026-55693, CVE-2026-57456, CVE-2026-55892, CVE-2026-57451, CVE-2026-57453, CVE-2026-57454
Upgrade xorg-x11-server-Xwayland to 24.1.12 for CVE-2026-50256, CVE-2026-50257, CVE-2026-50258, CVE-2026-50259, CVE-2026-50260, CVE-2026-50261, CVE-2026-50262 and CVE-2026-50263

Generic Kernel version-release: kernel-6.6.141.1-1

This targeted 3.0 release upgrades the kernel to 6.6.141.1 to reinstate the CX3 Driver support unintentionally dropped in the 6.6.139.1 kernel.

Generic Kernel version-release: kernel-6.6.139.1-1

Add gcab 1.6 cabinet archive library package
Add koji.
Add support for Azure Container Linux in WALinuxAgent
Enable edk2 aarch64 VMF build.
Enable missing kernel-mshv configs per customer request
Fix azcopy ptest
Fix azcopy ptests failure
Fix Cython ptest
Fix docs: remove/deprecate references to 2.0
Fix docs: update readme
Fix docs: update readme text
Fix git-lfs ptest
Fix git-lfs ptests failure
Fix haproxy config file overwrite on upgrade
Fix libical ptest
Fix librelp ptest
Fix lujavrite ptest
Fix ptest issue for libmicrohttpd
Fix python‑markdown ptest
Fix python‑tqdm ptest
Fix systemd unmanaged interface in networkd
Fix systemd unnecessary nftables initialization by backporting upstream
Patch application-gateway-kubernetes-ingress for CVE-2026-42506, CVE-2026-39821, CVE-2026-27136, CVE-2026-42502, CVE-2026-25681, CVE-2026-25680, CVE-2026-33814
Patch azcopy for CVE-2026-39821
Patch azurelinux-image-tools for CVE-2026-39821, CVE-2026-33814
Patch binutils for CVE-2025-3198
Patch binutils for CVE-2026-6846
Patch cert-manager for CVE-2026-46597, CVE-2026-42506, CVE-2026-39834, CVE-2026-39830, CVE-2026-39829, CVE-2026-39821, CVE-2026-27136, CVE-2026-42502, CVE-2026-39835, CVE-2026-39828, CVE-2026-39827, CVE-2026-25681, CVE-2026-25680, CVE-2026-35469, CVE-2026-33814
Patch cf-cli for CVE-2026-46597, CVE-2026-42506, CVE-2026-39834, CVE-2026-39830, CVE-2026-39829, CVE-2026-39821, CVE-2026-27136
Patch cloud-provider-kubevirt for CVE-2026-42506, CVE-2026-39821, CVE-2026-27136
Patch containerd2 for CVE-2026-27136, CVE-2026-39821, CVE-2026-39882, CVE-2026-33814, CVE-2026-42506,
Patch containerized-data-importer for CVE-2026-25681, CVE-2026-25680, CVE-2026-27136, CVE-2026-33814, CVE-2026-35469, CVE-2026-39821, CVE-2026-42502, CVE-2026-42506,
Patch coredns for CVE-2026-32936, CVE-2026-32934, CVE-2026-33489, CVE-2026-33190, CVE-2026-39821
Patch cri-tools for CVE-2026-35469, CVE-2026-42506, CVE-2026-39821, CVE-2026-27136, CVE-2026-42502, CVE-2026-25681, CVE-2026-25680
Patch curl for CVE-2026-7168, CVE-2026-6276, CVE-2026-4873
Patch docker-buildx for CVE-2026-46597, CVE-2026-42506, CVE-2026-39834, CVE-2026-39832, CVE-2026-39830, CVE-2026-39829, CVE-2026-39821, CVE-2026-27136, CVE-2026-35469
Patch docker-cli for CVE-2026-39821
Patch docker-compose for CVE-2026-35469, CVE-2026-46597, CVE-2026-42506, CVE-2026-39834, CVE-2026-39832, CVE-2026-39830, CVE-2026-39829, CVE-2026-39821, CVE-2026-27136
Patch etcd for CVE-2026-39821, CVE-2026-29181
Patch fio for CVE-2026-30656
Patch firewalld for CVE-2026-4948
Patch flannel for CVE-2026-39821
Patch gdb for CVE-2025-1178, CVE-2025-1176, CVE-2026-6846
Patch gh for CVE-2026-46597, CVE-2026-42506, CVE-2026-39834, CVE-2026-39830, CVE-2026-39829, CVE-2026-39821, CVE-2026-27136
Patch git-lfs for CVE-2026-39821
Patch glibc for CVE-2026-4046
Patch gnutls for CVE-2026-33845, CVE-2026-3832, CVE-2026-33846, CVE-2026-42010, CVE-2026-42009
Patch ignition-flatcar for CVE-2026-29181, CVE-2026-33814, CVE-2026-39821
Patch influxdb for CVE-2026-41602, CVE-2026-42506, CVE-2026-39821, CVE-2026-27136, CVE-2026-42502, CVE-2026-25681, CVE-2026-25680
Patch jq for CVE-2026-43896, CVE-2026-43895, CVE-2026-41257, CVE-2026-41256, CVE-2026-40612, CVE-2026-44777
Patch jx for CVE-2026-39821
Patch kata-containers for CVE-2026-41602, CVE-2026-39821, CVE-2026-33814
Patch kata-containers-cc for CVE-2026-41602, CVE-2026-39821, CVE-2026-33814
Patch keda for CVE-2026-42506, CVE-2026-39821, CVE-2026-27136, CVE-2026-35469
Patch kf-kcoreaddons for CVE-2026-41526
Patch krb5 for CVE-2026-40356
Patch kube-vip-cloud-provider for CVE-2026-42506, CVE-2026-39821, CVE-2026-27136, CVE-2026-42502, CVE-2026-25681, CVE-2026-25680
Patch kubernetes for CVE-2026-46597, CVE-2026-42506, CVE-2026-39834, CVE-2026-39830, CVE-2026-39829, CVE-2026-39821, CVE-2026-27136, CVE-2026-42502, CVE-2026-39835, CVE-2026-39827, CVE-2026-25681, CVE-2026-25680
Patch kubevirt for CVE-2026-7374, CVE-2026-33814, CVE-2026-35469, CVE-2026-46597, CVE-2026-42506, CVE-2026-39829, CVE-2026-39834, CVE-2026-39830, CVE-2026-39821, CVE-2026-27136, CVE-2026-42502, CVE-2026-39835, CVE-2026-39828, CVE-2026-39827, CVE-2026-25681, CVE-2026-25680
Patch kured for CVE-2026-35469, CVE-2026-39821
Patch libssh for CVE-2026-0968
Patch libyang for CVE-2026-41401, CVE-2026-44673
Patch memcached for CVE-2026-47783, CVE-2026-47784
Patch moby-containerd-cc for CVE-2026-35469, CVE-2026-39821
Patch moby-engine for CVE-2026-46597, CVE-2026-39834, CVE-2026-39830, CVE-2026-39829, CVE-2026-39821, CVE-2026-39835, CVE-2026-39827
Patch multus for CVE-2026-42506, CVE-2026-39821, CVE-2026-27136
Patch nano for CVE-2026-6843, CVE-2026-6842
Patch nginx for CVE-2026-8711, CVE-2026-9256,CVE-2026-42946, CVE-2026-42945, CVE-2026-42934, CVE-2026-40701, CVE-2026-40460
Patch nvidia-container-toolkit for CVE-2026-39834, CVE-2026-39830
Patch opa for CVE-2026-39821
Patch openvswitch for CVE-2026-34956
Patch packer for CVE-2026-33814, CVE-2026-46597, CVE-2026-42508, CVE-2026-42506, CVE-2026-39834, CVE-2026-39832, CVE-2026-39830, CVE-2026-39829, CVE-2026-39821, CVE-2026-27136, CVE-2026-46598, CVE-2026-42502, CVE-2026-39835, CVE-2026-39828, CVE-2026-39827, CVE-2026-25681, CVE-2026-25680
Patch perl-XML-LibXML for CVE-2026-8177
Patch prometheus-adapter for CVE-2026-42506, CVE-2026-39821, CVE-2026-27136, CVE-2026-42502, CVE-2026-25681, CVE-2026-25680
Patch prometheus-node-exporter for CVE-2026-39821
Patch prometheus-process-exporter for CVE-2026-39821
Patch python-click for CVE-2026-7246
Patch python-pip for CVE-2026-3219, CVE-2026-6357
Patch python-twisted for CVE-2026-42304
Patch python-urllib3 for CVE-2026-44431
Patch Python-virtualenv for CVE-2026-3219, CVE-2026-6357
Patch python3 for CVE-2026-1502
Patch pytorch for CVE-2025-51480
Patch rabbitmq-server for CVE-2026-8466, CVE-2026-7790, CVE-2026-43968
Patch rust-afterburn for CVE-2026-25541
Patch skopeo for CVE-2026-39821
Patch sriov-network-device-plugin for CVE-2026-42506, CVE-2026-39821, CVE-2026-27136, CVE-2026-42502, CVE-2026-25681, CVE-2026-25680
Patch systemd for CVE-2026-40226, CVE-2026-40225
Patch telegraf for CVE-2026-41602, CVE-2026-42154, CVE-2026-46597, CVE-2026-42508, CVE-2026-42506, CVE-2026-39834, CVE-2026-39832, CVE-2026-39830, CVE-2026-39829, CVE-2026-39821, CVE-2026-27136, CVE-2026-42151, CVE-2026-41889
Patch thrift for CVE-2026-41636, CVE-2026-41605, CVE-2026-41603, CVE-2026-41602, CVE-2025-48431
Patch vitess for CVE-2026-39821
qemu: Enable user_static builds for providing user mode emulation.
Remove nodejs 20 package and make nodejs 24 as default nodejs package
Resolved ptest failure in azcopy package
Resolved ptest failure in git-lfs package
Resolved ptest failure in libical by upgrading to version 3.0.10
Resolved ptest failure in lujavrite package
Upgrade azurelinux-image-tools to 1.4.0 (fasttrack)
Upgrade bind to 9.20.23 for CVE-2026-3039, CVE-2026-3592, CVE-2026-3593, CVE-2026-5946, CVE-2026-5947, CVE-2026-5950
Upgrade containerd2 to 2.2.4
Upgrade cups to 2.4.19 for CVE-2026-41079
Upgrade dnsmasq to 2.92 for CVE-2026-2291, CVE-2026-4890, CVE-2026-4891, CVE-2026-4892, CVE-2026-4893, CVE-2026-5172
Upgrade etcd to 3.5.30 for CVE-2026-44283
Upgrade frr to 10.5.4 for CVE-2026-37457
Upgrade golang to 1.25.10-1
Upgrade golang to 1.26.3-1
Upgrade haveged to 1.9.22 for CVE-2026-41054
Upgrade httpd to 2.4.67 for CVE-2026-29168, CVE-2026-24072, CVE-2026-34059, CVE-2026-23918, CVE-2026-33857, CVE-2026-34032, CVE-2026-33006, CVE-2026-33007, CVE-2026-29169, CVE-2026-33523
Upgrade kernel-mshv and kernel-uvm to 6.6.137.mshv1
Upgrade libpng to 1.6.58 for a regression introduced in version 1.6.56 that caused to return stale palette data after applying gamma and background transforms in-place
Upgrade mariadb to 10.11.18 for CVE-2026-44168, CVE-2026-44169, CVE-2026-44170, CVE-2026-44171, CVE-2026-44172, CVE-2026-44173, CVE-2026-48165, CVE-2026-48163
Upgrade perl-libwww-perl to 6.83 for CVE-2026-8368
Upgrade pgbouncer to 1.25.2 for CVE-2026-6664, CVE-2026-6665, CVE-2026-6666, CVE-2026-6667
Upgrade php to 8.3.31 for CVE-2026-7261, CVE-2026-7258, CVE-2026-6722, CVE-2026-6735, CVE-2026-7262, CVE-2025-14179, CVE-2026-7568, CVE-2026-7259
Upgrade postgresql to 16.14 for CVE-2026-6473, CVE-2026-6479, CVE-2026-6638, CVE-2026-6474, CVE-2026-6475, CVE-2026-6477, CVE-2026-6478, CVE-2026-6472, CVE-2026-6637
Upgrade python-mistune to 3.2.1 for CVE-2026-33079
Upgrade rsync to 3.4.3 for CVE-2026-43617, CVE-2026-43618, CVE-2026-43619, CVE-2026-43620, CVE-2026-45232, CVE-2026-29518, CVE-2026-41035
Upgrade unbound to 1.25.1 for CVE-2026-33278, CVE-2026-42944, CVE-2026-42959, CVE-2026-32792, CVE-2026-40622, CVE-2026-41292, CVE-2026-42534, CVE-2026-42923, CVE-2026-42960, CVE-2026-44390, CVE-2026-44608
Upgrade valkey to 8.0.9 for CVE-2026-23479, CVE-2026-25243, CVE-2026-23631
Upgrade vim to 9.2.0488 for CVE-2026-45130, CVE-2026-44656, CVE-2026-46483

Generic Kernel version-release: kernel-6.6.139.1-1

Upgrade kernel to 6.6.139.1-1 for CVE-2026-46333
Upgrade kernel-hwe to 6.12.89.1-1 for CVE-2026-46333

Generic Kernel version-release: kernel-6.6.138.1-1

This kernel only release is to resolve the "CopyFail2" aka "dirty-frag" security vulnerability: CVE-2026-43284 / CVE-2026-43500

Upgrade kernel to version 6.6.138.1-1
Upgrade kernel to version 6.12.87.1

Generic Kernel version-release: kernel-6.6.137.1-2

Add extra macros parameter to PackageBuild.yml
Add ignition to SPECS/SPECS-EXTENDED
Add rust-afterburn to SPECS/SPECS-EXTENDED
Build Wireshark package with Lua support
Cleanup unwanted files for coreos-init
Enable CONFIG_IKCONFIG_PROC on arm64 kernel
Fix c-ares ptest
Fix check before copying cfg.SrpmsDir
Fix IC golden container pip install failure under CFSClean network isolation
Fix python-google-auth-oauthlib ptest
Fix python-pytest-xdist ptest
Fix qemu-guest-agent startup failure by replacing --blacklist with --block-rpcs
Fix shim update sbat csv to match architecture
Fix systemd pcrlock failure on Hyper-V VMs with vTPM
Improve Live Migration support in QEMU
Patch avahi for CVE-2026-34933
Patch binutils for CVE-2025-69652, CVE-2025-69649, CVE-2025-69646, CVE-2025-69645, CVE-2025-11839, CVE-2025-1148, CVE-2025-1147, CVE-2025-69647, CVE-2026-4647
Patch clamav for CVE-2026-33056, CVE-2026-33055
patch containerd2 for CVE-2026-35469, CVE-2026-34986
Patch containerized-data-importer for CVE-2026-32288
Patch crash for CVE-2026-4647
Patch curl for CVE-2026-3784, CVE-2026-3783, CVE-2026-1965
Patch edk2 for CVE-2026-28390, CVE-2026-28389
Patch emacs for CVE-2026-6861
Patch erlang for CVE-2026-28808, CVE-2026-32147
Patch expat for CVE-2026-32778, CVE-2026-32777, CVE-2026-32776
Patch fluent-bit for CVE-2025-63652 and CVE-2025-63657
Patch frr for CVE-2026-28532, CVE-2026-5107
Patch gdb for CVE-2026-4647
Patch gdk-pixbuf2 for CVE-2026-5201
Patch gh for CVE-2026-32288, CVE-2026-5160
Patch haproxy for CVE-2026-33555
Patch ignition-flatcar for CVE-2026-27141
Patch jq for CVE-2026-40164, CVE-2026-39979, CVE-2026-39956, CVE-2026-33948, CVE-2026-33947, CVE-2026-32316
Patch keras for CVE-2026-1669
Patch kubernetes for CVE-2026-35469
Patch lcms2 for CVE-2026-41254
Patch libarchive for CVE-2026-5121, CVE-2026-4426, CVE-2026-4424
Patch libcap for CVE-2026-4878
Patch libexif for CVE-2026-40386, CVE-2026-40385
Patch libgcrypt for CVE-2026-41989
Patch libsoup for CVE-2026-2436
Patch libssh for CVE-2026-0967, CVE-2026-0966, CVE-2026-0965, CVE-2026-0964
Patch libssh2 for CVE-2026-7598
Patch libtiff for CVE-2026-4775
Patch mesa for CVE-2026-40393
Patch moby-containerd-cc for CVE-2026-39882
Patch moby-engine for CVE-2026-32288, CVE-2026-39882
Patch nodejs for CVE-2026-21716, CVE-2026-21715, CVE-2026-21714, CVE-2026-21713, CVE-2026-21710
Patch nodejs24 for CVE-2026-33672, CVE-2026-33671, CVE-2026-21710, CVE-2026-21637, CVE-2026-21717, CVE-2026-21713, CVE-2026-21714, CVE-2026-21712, CVE-2026-21716, CVE-2026-21715
Patch ntfs-3g for CVE-2026-40706
Patch openssh for CVE-2026-35414, CVE-2026-35388, CVE-2026-35386, CVE-2026-35385
Patch openssl for ....
Patch perl-XML-Parser for CVE-2006-10003, CVE-2006-10002
Patch poetry for CVE-2026-34591
Patch protobuf for CVE-2026-6409
Patch python-lxml for CVE-2026-41066
Patch python-mako for CVE-2026-41205
Patch python-wheel for CVE-2026-24049
Patch pytorch for CVE-2026-34446, CVE-2026-34445
Patch rpm-ostree for CVE-2026-33056, CVE-2026-33055
Patch ruby for CVE-2026-27820
Patch rubygem-faraday for CVE-2026-25765
Patch rubygem-rdiscount for CVE-2026-35201
Patch rust for CVE-2026-2006, CVE-2026-33056, CVE-2026-33055, CVE-2026-34743
Patch sed for CVE-2026-5958
Patch skopeo for CVE-2026-32288
Patch sleuthkit for CVE-2026-40026, CVE-2026-40025, CVE-2026-40024
Patch sqlite for CVE-2025-70873
Patch sudo for CVE-2026-35535
Patch systemd-bootstrap for CVE-2026-29111
Patch telegraf for CVE-2026-33216, CVE-2026-29785 CVE-2026-5160
Patch util-linux for CVE-2026-3184, CVE-2026-27456
Patch vim for CVE-2026-34714, CVE-2026-34982, CVE-2026-35177, CVE-2026-39881, CVE-2026-41411
Patch xorg-x11-server-Xwayland for CVE-2026-34003, CVE-2026-34001, CVE-2026-33999
Patch xz for CVE-2026-34743
Update kernel-uvm-micro config to be able to start kata pod
Upgrade buildah to 1.43.1
upgrade clamav to 1.5.2
Upgrade cloud-hypervisor to v51.1.56
Upgrade containerd2 version to 2.1.6
Upgrade cups to 2.4.18 for CVE-2026-39316, CVE-2026-39314, CVE-2026-34979, CVE-2026-34980 and to fix cupsd crash if user does not exist.
Upgrade erlang to 26.2.5.20 for CVE-2026-28808 and CVE-2026-32147
Upgrade freeipmi to 1.6.17 for CVE-2026-33554
Upgrade golang to 1.26.2-1 and 1.25.9-1
Upgrade irqbalance to 1.9.5 and patch for ENOSPC handling
Upgrade kernel to 6.6.137.1
Upgrade kernel version-release: kernel-6.6.137.1-2
Upgrade kernel-mshv to 6.6.135.mshv2
Upgrade kernel-uvm to 6.6.130.mshv1
Upgrade libpng to 1.6.57 for CVE-2026-34757
Upgrade mysql to 8.0.46
Upgrade python-ecdsa to 0.19.2 for CVE-2026-33936
Upgrade rubygem-addressable to 2.9.0 for CVE-2026-35611
Upgrade vim to 9.2.0323 for CVE-2026-34714, CVE-2026-34982, CVE-2026-35177, CVE-2026-39881, CVE-2026-41411

Note

On the next monthly update (the June Update) the nodejs package will automatically redirect to nodejs24. nodejs20 is End of Life and no longer supported.