flatcar/scripts alpha-4865.0.0

on GitHub

Changes since Alpha 4820.0.1

Security fixes:

• Linux (CVE-2026-98260, CVE-2026-99999, ... skipped due to text size limitation)
• Go (CVE-2026-111943, CVE-2026-56857, CVE-2026-56866, CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78667, CVE-2026-78669, CVE-2026-94439, CVE-2026-94440, CVE-2026-94444, CVE-2026-94447, CVE-2026-94448, CVE-2026-97030, CVE-2026-97031, CVE-2026-97032)
• containerd (CVE-2026-53495, GHSA-rp3h-jf77-q9p4)
• cpio (CVE-2026-66485, CVE-2026-66486)
• cri-tools (CVE-2026-34040, CVE-2026-41567, CVE-2026-42306, CVE-2026-39883)
• crun (CVE-2026-88264, CVE-2026-88265)
• curl (CVE-2026-13608, CVE-2026-18924, CVE-2026-19931, CVE-2026-80229, CVE-2026-80230, CVE-2026-80231, CVE-2026-80255, CVE-2026-80256, CVE-2026-86409, CVE-2026-86410, CVE-2026-86411, CVE-2026-86412, CVE-2026-86413, CVE-2026-86414, CVE-2026-86415, CVE-2026-87861, CVE-2026-87862, CVE-2026-87863, CVE-2026-87864, CVE-2026-87865, CVE-2026-87866, CVE-2026-92386, CVE-2026-92387, CVE-2026-92388, CVE-2026-92389, CVE-2026-92390, CVE-2026-92391, CVE-2026-92392, CVE-2026-94265, CVE-2026-94266, CVE-2026-107928, CVE-2026-107929)
• gawk (CVE-2026-40553, CVE-2026-40467, CVE-2026-40468)
• libpcap (CVE-2026-0799, CVE-2026-18238, CVE-2026-18313, CVE-2026-31911, CVE-2026-31912, CVE-2026-6244, CVE-2026-6554)
• libpcre2 (CVE-2026-86145, CVE-2026-89156, CVE-2026-89161, GHSA-9qww-pwc4-77qq, GHSA-q7rw-r7qq-2hx6)
• libxml2 (CVE-2026-86137, CVE-2026-86138, CVE-2026-86139, CVE-2026-86140, CVE-2026-86141, CVE-2026-86142, CVE-2026-86143, CVE-2026-86144)
• nghttp2 (CVE-2026-58055)
• python (CVE-2026-19672)
• sssd (CVE-2026-87853)
• xz-utils (GHSA-5qpq-xqfv-j9pg)

Bug fixes:

• AWS arm64: Removed bare earlycon from the kernel command line. It took the UART address from the ACPI SPCR table, which is wrong on Graviton, and could hang boot when an NVMe device was mapped at that address, e.g. on t4g instances with an additional EBS volume. (Flatcar#2446)
• Alpha and Beta only: Fixed SSH client that was broken by a configuration file with bad permissions being unreadable. (scripts#4338)
• STACKIT: Masked systemd-timesyncd.service in the OEM sysext. It conflicts with chronyd.service, and which of the two ended up running after boot depended on timing. (scripts#4318)

Changes:

• Provided NVIDIA 580 (LTS branch) driver sysexts as nvidia-drivers-580 and nvidia-drivers-580-open. Write the name to /etc/flatcar/enabled-sysext.conf through Ignition to use them. The 535, 550 and 570 branches are end-of-life upstream; switching to 580 is recommended.
• The system CA bundle now only contains roots that Mozilla trusts for TLS. The 49 roots that Mozilla trusts only for S/MIME (email) were removed from /etc/ssl/certs and ca-certificates.crt, reducing the bundle from 167 to 118 roots. (scripts#4333)

Updates:

• Go (1.26.10 (includes 1.26.8, 1.26.9))
• Linux (6.18.58 (includes 6.18.57, 6.18.56, 6.18.55, 6.18.54, 6.18.53, 6.18.52, 6.18.51, 6.18.50, 6.18.49, 6.18.48, 6.18.47, 6.18.46, 6.18.45))
• Linux Firmware (20261019 (includes 20260916))
• SDK: pkgcheck (0.10.43)
• base, dev: checkpolicy (3.11)
• base, dev: cri-tools (1.37.0)
• base, dev: curl (8.23.0 (includes 8.22.0))
• base, dev: dracut (112)
• base, dev: gawk (5.4.1 (includes 5.4.0))
• base, dev: libgcrypt (1.12.4)
• base, dev: libpcap (1.10.7)
• base, dev: libpcre2 (10.48)
• base, dev: libxml2 (2.15.4)
• base, dev: nghttp2 (1.70.0)
• base, dev: nvidia-drivers-service (580.178.04)
• base, dev: pkgconf (3.0.7 (includes 3.0.0))
• base, dev: selinux-base (2.20260616_p1)
• base, dev: selinux-base-policy (2.20260616_p1)
• base, dev: selinux-container (2.20260616_p1)
• base, dev: selinux-dbus (2.20260616_p1)
• base, dev: selinux-policykit (2.20260616_p1)
• base, dev: selinux-sssd (2.20260616_p1)
• base, dev: selinux-unconfined (2.20260616_p1)
• base, dev: xz-utils (5.8.4)
• ca-certificates (3.132 (includes 3.131.1, 3.131))
• dev: gnuconfig (20260517)
• sysext-containerd: containerd (2.3.5)
• sysext-podman: crun (1.29.1 (includes 1.29))
• sysext-python: platformdirs (4.11.3 (includes 4.11.2, 4.11.1, 4.11.0))
• sysext-python: setuptools (84.0.0)
• sysext-python: wheel (0.48.0)