flatcar/scripts beta-4820.1.0

on GitHub

Changes since Beta 4790.1.1

Security fixes:

• Linux (CVE-2026-98618, CVE-2026-98626, CVE-2026-98625, CVE-2026-98624, CVE-2026-98623, CVE-2026-98622, CVE-2026-98621, CVE-2026-98647, CVE-2026-98646, CVE-2026-98644, CVE-2026-98643, CVE-2026-98642, CVE-2026-98641, CVE-2026-98640, CVE-2026-98620, CVE-2026-98636, CVE-2026-98634, CVE-2026-98632, CVE-2026-98631, CVE-2026-98629, CVE-2026-98573, CVE-2026-98582, CVE-2026-98581, CVE-2026-98580, CVE-2026-98579, CVE-2026-98578, CVE-2026-98615, CVE-2026-98614, CVE-2026-98613, CVE-2026-98577, CVE-2026-98612, CVE-2026-98611, CVE-2026-98610, CVE-2026-98609, CVE-2026-98608, CVE-2026-98607, CVE-2026-98606, CVE-2026-98605, CVE-2026-98576, CVE-2026-98602, CVE-2026-98601, CVE-2026-98600, CVE-2026-98597, CVE-2026-98596, CVE-2026-98594, CVE-2026-98593, CVE-2026-98575, CVE-2026-98591, CVE-2026-98590, CVE-2026-98588, CVE-2026-98586, CVE-2026-98583, CVE-2026-98528, CVE-2026-98537, CVE-2026-98536, CVE-2026-98535, CVE-2026-98534, CVE-2026-98533, CVE-2026-98572, CVE-2026-98569, CVE-2026-98568, CVE-2026-98532, CVE-2026-98567, CVE-2026-98566, CVE-2026-98565, CVE-2026-98561, CVE-2026-98559, CVE-2026-98531, CVE-2026-98555, CVE-2026-98554, CVE-2026-98553, CVE-2026-98550, CVE-2026-98549, CVE-2026-98548, CVE-2026-98547, CVE-2026-98546, CVE-2026-98545, CVE-2026-98544, CVE-2026-98541, CVE-2026-98539, CVE-2026-98538, CVE-2026-98529, CVE-2026-98483, CVE-2026-98491, CVE-2026-98490, CVE-2026-98489, CVE-2026-98488, CVE-2026-98527, CVE-2026-98526, CVE-2026-98525, CVE-2026-98524, CVE-2026-98523, CVE-2026-98487, CVE-2026-98522, CVE-2026-98521, CVE-2026-98519, CVE-2026-98517, CVE-2026-98516, CVE-2026-98515, CVE-2026-98514, CVE-2026-98513, CVE-2026-98486, CVE-2026-98512, CVE-2026-98511, CVE-2026-98510, CVE-2026-98509, CVE-2026-98508, CVE-2026-98507, CVE-2026-98506, CVE-2026-98505, CVE-2026-98504, CVE-2026-98503, CVE-2026-98485, CVE-2026-98502, CVE-2026-98501, CVE-2026-98499, CVE-2026-98498, CVE-2026-98495, CVE-2026-98494, CVE-2026-98493, CVE-2026-98484, CVE-2026-98448, CVE-2026-98482, CVE-2026-98481, CVE-2026-98479, CVE-2026-98477, CVE-2026-98476, CVE-2026-98475, CVE-2026-98473, CVE-2026-98468, CVE-2026-98465, CVE-2026-98464, CVE-2026-98462, CVE-2026-98461, CVE-2026-98460, CVE-2026-98442, CVE-2026-98459, CVE-2026-98457, CVE-2026-98456, CVE-2026-98455, CVE-2026-98454, CVE-2026-98452, CVE-2026-98441, CVE-2026-98435, CVE-2026-98433, CVE-2026-98413, CVE-2026-98412, CVE-2026-98411, CVE-2026-98410, CVE-2026-98409, CVE-2026-98430, CVE-2026-98429, CVE-2026-98428, CVE-2026-98426, CVE-2026-98425, CVE-2026-98407, CVE-2026-98423, CVE-2026-98422, CVE-2026-98421, CVE-2026-98419, CVE-2026-98417, CVE-2026-98416, CVE-2026-98405, CVE-2026-98406, CVE-2026-98403, CVE-2026-98386, CVE-2026-98384, CVE-2026-98383, CVE-2026-98382, CVE-2026-98381, CVE-2026-98380, CVE-2026-98379, CVE-2026-98378, CVE-2026-98377, CVE-2026-98373, CVE-2026-98374, CVE-2026-98360, CVE-2026-98369, CVE-2026-98368, CVE-2026-98367, CVE-2026-98366, CVE-2026-98365, CVE-2026-98363, CVE-2026-98362, CVE-2026-98370, CVE-2026-98322, CVE-2026-98331, CVE-2026-98329, CVE-2026-98328, CVE-2026-98327, CVE-2026-98326, CVE-2026-98359, CVE-2026-98358, CVE-2026-98357, CVE-2026-98354, CVE-2026-98352, CVE-2026-98325, CVE-2026-98351, CVE-2026-98349, CVE-2026-98348, CVE-2026-98862, CVE-2026-98860, CVE-2026-98859, CVE-2026-98858, CVE-2026-98857, CVE-2026-98856, CVE-2026-98855, CVE-2026-98854, CVE-2026-98811, CVE-2026-98809, CVE-2026-98808, CVE-2026-98852, CVE-2026-98807, CVE-2026-98851, CVE-2026-98850, CVE-2026-98849, CVE-2026-98848, CVE-2026-98847, CVE-2026-98846, CVE-2026-98845, CVE-2026-98844, CVE-2026-98841, CVE-2026-98840, CVE-2026-98838, CVE-2026-98837, CVE-2026-98836, CVE-2026-98835, CVE-2026-98833, CVE-2026-98805, CVE-2026-98831, CVE-2026-98830, CVE-2026-98828, CVE-2026-98827, CVE-2026-98826, CVE-2026-98825, CVE-2026-98823, CVE-2026-98822, CVE-2026-98819, CVE-2026-98812, CVE-2026-98752, CVE-2026-98761, CVE-2026-98760, CVE-2026-98758, CVE-2026-98757, CVE-2026-98801, CVE-2026-98798, CVE-2026-98797, CVE-2026-98796, CVE-2026-98794, CVE-2026-98793, CVE-2026-98792, CVE-2026-98756, CVE-2026-98791, CVE-2026-98790, CVE-2026-98785, CVE-2026-98784, CVE-2026-98783, CVE-2026-98782, CVE-2026-98755, CVE-2026-98781, CVE-2026-98780, CVE-2026-98779, CVE-2026-98778, CVE-2026-98777, CVE-2026-98775, CVE-2026-98773, CVE-2026-98772, CVE-2026-98754, CVE-2026-98771, CVE-2026-98770, CVE-2026-98769, CVE-2026-98768, CVE-2026-98767, CVE-2026-98766, CVE-2026-98765, CVE-2026-98764, CVE-2026-98763, CVE-2026-98762, CVE-2026-98753, CVE-2026-98703, CVE-2026-98711, CVE-2026-98710, CVE-2026-98709, CVE-2026-98708, CVE-2026-98751, CVE-2026-98750, CVE-2026-98749, CVE-2026-98748, CVE-2026-98746, CVE-2026-98745, CVE-2026-98744, CVE-2026-98743, CVE-2026-98707, CVE-2026-98742, CVE-2026-98741, CVE-2026-98739, CVE-2026-98738, CVE-2026-98737, CVE-2026-98736, CVE-2026-98735, CVE-2026-98734, CVE-2026-98733, CVE-2026-98706, CVE-2026-98732, CVE-2026-98731, CVE-2026-98730, CVE-2026-98728, CVE-2026-98727, CVE-2026-98726, CVE-2026-98725, CVE-2026-98705, CVE-2026-98722, CVE-2026-98721, CVE-2026-98720, CVE-2026-98717, CVE-2026-98716, CVE-2026-98713, CVE-2026-98704, CVE-2026-98655, CVE-2026-98664, CVE-2026-98663, CVE-2026-98662, CVE-2026-98661, CVE-2026-98660, CVE-2026-98702, CVE-2026-98701, CVE-2026-98700, CVE-2026-98699, CVE-2026-98698, CVE-2026-98697, CVE-2026-98696, CVE-2026-98695, CVE-2026-98694, CVE-2026-98687, CVE-2026-98686, CVE-2026-98658, CVE-2026-98681, CVE-2026-98680, CVE-2026-98679, CVE-2026-98677, CVE-2026-98657, CVE-2026-98673, CVE-2026-98672, CVE-2026-98671, CVE-2026-98670, CVE-2026-98669, CVE-2026-98668, CVE-2026-98666, CVE-2026-98665, CVE-2026-98656, CVE-2026-98440, CVE-2026-98445, CVE-2026-98443, CVE-2026-98458, CVE-2026-98453, CVE-2026-98451, CVE-2026-98450, CVE-2026-99999, CVE-2026-98432, CVE-2026-98260)
• Go (CVE-2026-111943, CVE-2026-56857, CVE-2026-56866, CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78667, CVE-2026-78669, CVE-2026-94439, CVE-2026-94440, CVE-2026-94444, CVE-2026-94447, CVE-2026-94448, CVE-2026-97030, CVE-2026-97031, CVE-2026-97032)
• Ignition (CVE-2026-34986, CVE-2026-29181, CVE-2026-24051, CVE-2026-39883, CVE-2026-33186)
• bubblewrap (CVE-2026-87766)
• bzip2 (CVE-2026-42250)
• c-ares (CVE-2026-33630, GHSA-pjmc-gx33-gc76, GHSA-jv8r-gqr9-68wj)
• ca-certificates (CVE-2026-111943)
• containerd (CVE-2026-24051, CVE-2026-33186, CVE-2026-34986, CVE-2026-35469, CVE-2026-39883)
• coreutils (CVE-2026-56391, CVE-2026-56392)
• cri-tools (CVE-2026-32285, CVE-2026-24051, CVE-2026-33186)
• diffutils (CVE-2026-53910)
• docker (CVE-2026-24051, CVE-2026-33186, CVE-2026-33997, CVE-2026-34040, CVE-2026-39883, CVE-2026-41567, CVE-2026-42306, CVE-2026-33747, CVE-2026-33748, CVE-2026-46680)
• docker-buildx (CVE-2025-0495)
• etcd (CVE-2025-22869, CVE-2025-30204, CVE-2026-33186, CVE-2026-73500)
• expat (CVE-2026-66046, CVE-2026-72522, CVE-2026-76641, CVE-2026-76956, CVE-2026-76957)
• glib (CVE-2026-15588)
• go (CVE-2026-27145, CVE-2026-33818, CVE-2026-39821, CVE-2026-39822, CVE-2026-42504, CVE-2026-42505, CVE-2026-42507, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862, CVE-2026-56864, CVE-2026-56865)
• gzip (CVE-2026-41991)
• incus (CVE-2026-62867, CVE-2026-62940, CVE-2026-62941, CVE-2026-63125, CVE-2026-63343, CVE-2026-81500, CVE-2026-81501, GHSA-26gp-p5fw-3r2h, GHSA-67qw-68v3-36h6, GHSA-7fj9-65v4-rp7h, GHSA-p2v3-6wvc-cv3p, GHSA-4qxq-p5hm-3q3p, GHSA-m3j6-p3v3-qmjv, CVE-2026-62313, GHSA-6v6x-387m-rj4w)
• intel-microcode (CVE-2025-31936, CVE-2025-31938, CVE-2025-35973, CVE-2026-20707, CVE-2026-20713, CVE-2026-20716, CVE-2026-20760, CVE-2026-20917)
• jq (CVE-2026-32316, CVE-2026-33947, CVE-2026-33948, CVE-2026-39956, CVE-2026-39979, CVE-2026-40164, CVE-2026-41256, CVE-2026-41257, CVE-2026-43894, CVE-2026-43895, CVE-2026-43896, CVE-2026-44777, CVE-2026-47770, CVE-2026-49839, CVE-2026-54679)
• json-c (CVE-2026-9146)
• less (less-20260606)
• libgcrypt (libgcrypt-20260826)
• libksba (libksba-20260824)
• libseccomp (GHSA-2hqh-5c36-grrm, GHSA-46fr-jh49-xvhx, GHSA-4q85-33p6-j5g6)
• libxml2 (CVE-2026-11979)
• mit-krb5 (CVE-2026-40355, CVE-2026-40356)
• open-iscsi (CVE-2026-44943, CVE-2026-44944)
• opensc (CVE-2025-13763, CVE-2025-49010, CVE-2025-66037, CVE-2025-66038, CVE-2025-66215)
• openssh (CVE-2026-73281, CVE-2026-73282, CVE-2026-73283)
• openssl (CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075, CVE-2026-63076, CVE-2026-75803)
• p11-kit (CVE-2026-13757)
• pam (CVE-2026-54411)
• policycoreutils (CVE-2026-59676, CVE-2026-59677)
• python (CVE-2026-1502, CVE-2026-6100, CVE-2026-15308)
• qemu (CVE-2026-3886)
• rpcbind (CVE-2026-16277, CVE-2026-16461)
• rsync (CVE-2026-53783, CVE-2026-53784, CVE-2026-53785, CVE-2026-53786, CVE-2026-53788, CVE-2026-53789, CVE-2026-53790, CVE-2026-53791, CVE-2026-53792, CVE-2026-53793, CVE-2026-53794, CVE-2026-53795, CVE-2026-53796, CVE-2026-53797, CVE-2026-53798, CVE-2026-53799, CVE-2026-53800, CVE-2026-53801, CVE-2026-53802, CVE-2026-53803, CVE-2026-70452, CVE-2026-70453, CVE-2026-70454, CVE-2026-70455, CVE-2026-70456, CVE-2026-70457, CVE-2026-70458, CVE-2026-70459, CVE-2026-70460, CVE-2026-70461, CVE-2026-70462, CVE-2026-70463, CVE-2026-70464)
• socat (CVE-2026-56123)
• sssd (CVE-2026-12610, CVE-2026-14474, CVE-2026-14476)
• tpm2-tools (GHSA-v7w4-4gc9-qcgv, GHSA-gwfg-w3jr-xh66, GHSA-qp88-8f4j-wv7q)
• tpm2-tss (GHSA-q759-vqg7-8rc5, GHSA-7638-f8gq-c475, GHSA-p3px-r4mm-jpw5, GHSA-x5j2-26fc-hhc3, GHSA-gf8g-2r5c-74c7, GHSA-mj78-pj5v-wvjx, GHSA-v2qp-xh5m-44mf, GHSA-2q5v-c7hv-fvpf, GHSA-pcpw-8625-jqcp, GHSA-6grq-c24j-xcjr)
• unzip (CAN-2026-2034440, CAN-2026-2034442, CAN-2026-2034443)
• util-linux (CVE-2026-13595, CVE-2026-53612, CVE-2026-53613, CVE-2026-53614, CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410)
• wget (CVE-2026-15146, CVE-2026-58469, CVE-2026-58470, CVE-2026-58471, CVE-2026-58472)
• zfs (CVE-2026-79619)
• zip (zip-20260814)

Bug fixes:

• AWS arm64: Removed bare earlycon from the kernel command line. It took the UART address from the ACPI SPCR table, which is wrong on Graviton, and could hang boot when an NVMe device was mapped at that address, e.g. on t4g instances with an additional EBS volume. (Flatcar#2446)
• Fixed swtpm process cleanup in QEMU launcher on macOS by using POSIX kill -0 instead of checking Linux-only /proc.
• Improved early boot ip= kernel command line handling by dropping Flatcar's custom parser in favour of systemd-network-generator. IPv6 and VLANs should work better, and it will no longer assign the given IP address to the loopback interface if you don't specify the device name. If you used dhcp,dhcp6 for a dual stack configuration, you should now specify any instead. (Flatcar#1708, Flatcar#1894, Flatcar#2002)
• STACKIT: Masked systemd-timesyncd.service in the OEM sysext. It conflicts with chronyd.service, and which of the two ended up running after boot depended on timing. (scripts#4318)

Changes:

• Removed the net-misc/bridge-utils package. It is deprecated upstream in favor of the bridge utility from iproute2, which Flatcar ships through sys-apps/iproute2. Use ip link add ... type bridge instead of brctl addbr .... (Flatcar#638)

Updates:

• Ignition (2.27.0 (includes 2.26.0, 2.25.1, 2.25.0))
• Linux (6.12.113 (includes 6.12.112))
• Linux Firmware (20260810)
• SDK: bubblewrap (0.12.0)
• SDK: cmake (4.3.4)
• SDK: go (1.26.10 (includes 1.26.4, 1.26.5, 1.26.6, 1.26.7, 1.26.8, 1.26.9))
• SDK: meson (1.11.2)
• SDK: nasm (3.02)
• SDK: opensc (0.27.1)
• SDK: pkgcheck (0.10.42 (includes 0.10.41, 0.10.40))
• SDK: qemu (10.2.3)
• SDK: rust (1.97.1 (includes 1.97.0), 1.96.1, 1.96.0)
• azure, dev, gce, sysext-python: python (3.13.15)
• base, dev: acl (2.4.0)
• base, dev: attr (2.6.0)
• base, dev: bash (5.3_p15)
• base, dev: bind (9.20.26 (includes 9.20.25, 9.20.24))
• base, dev: btrfs-progs (7.1)
• base, dev: c-ares (1.34.8 (includes 1.34.7))
• base, dev: cri-tools (1.36.0 (includes 1.35.0, 1.34.0))
• base, dev: cryptsetup (2.8.7)
• base, dev: etcd (3.5.33)
• base, dev: expat (2.8.4 (includes 2.8.3))
• base, dev: findutils (4.11.0)
• base, dev: git (2.55.0)
• base, dev: glib (2.88.3)
• base, dev: gnupg (2.5.21)
• base, dev: intel-microcode (20260812_p20260813 (includes 20260811_p20260811))
• base, dev: jansson (2.15.1)
• base, dev: jq (1.8.2)
• base, dev: json-c (0.19)
• base, dev: leancrypto (1.8.0)
• base, dev: less (704 (includes 702))
• base, dev: libarchive (3.8.9)
• base, dev: libevent (2.1.13)
• base, dev: libgcrypt (1.12.3)
• base, dev: libgpg-error (1.61)
• base, dev: libksba (1.8.1)
• base, dev: libnvme (1.16.2)
• base, dev: libseccomp (2.6.1)
• base, dev: libselinux (3.11)
• base, dev: libsemanage (3.11 (includes 3.10, 3.9))
• base, dev: libsepol (3.11)
• base, dev: liburing (2.12 (includes 2.11, 2.10))
• base, dev: lsof (4.99.7)
• base, dev: nghttp2 (1.69.0)
• base, dev: ngtcp2 (1.24.0 (includes 1.23.0))
• base, dev: openssh (10.5_p1 (includes 10.4_p1))
• base, dev: p11-kit (0.26.4 (includes 0.26.3))
• base, dev: pinentry (1.3.3)
• base, dev: policycoreutils (3.11 (includes 3.10, 3.9))
• base, dev: rsync (3.5.0)
• base, dev: samba (4.24.4 (includes 4.24.3, 4.24.2, 4.24.1, 4.24.0))
• base, dev: semodule-utils (3.11)
• base, dev: shadow (4.20.0)
• base, dev: socat (1.8.1.3)
• base, dev: sqlite (3.53.3)
• base, dev: sssd (2.13.1)
• base, dev: strace (7.1)
• base, dev: systemd (261.2)
• base, dev: tpm2-tools (5.8)
• base, dev: tpm2-tss (4.2.0)
• base, dev: unzip (6.0_p31)
• base, dev: util-linux (2.42.2 (includes 2.42.1, 2.42))
• base, dev: util-linux (2.42.3)
• base, dev: zip (3.0_p16)
• ca-certificates (3.131.1, 3.131)
• dev: bash-completion (2.18.0)
• dev: binutils (2.46.1)
• dev: file (5.48)
• dev: gentoolkit (0.8.0 (includes 0.7.6))
• dev: pahole (1.31)
• dev: portage (3.0.81.3 (includes 3.0.81.2))
• dev: sandbox (2.49)
• python (3.13.14)
• sysext-containerd: containerd (2.3.4 (includes 2.3.3, 2.3.2, 2.3.1, 2.3.0))
• sysext-docker: docker (29.8.0 (includes 29.7.0, 29.6.0, 29.5.2, 29.5.1, 29.5.0, 29.4.0, 29.3.0, 29.2.0))
• sysext-docker: docker-buildx (0.35.0)
• sysext-docker: docker-cli (29.5.2 (includes 29.5.1, 29.5.0, 29.4.0, 29.3.0, 29.2.0))
• sysext-incus: incus (7.4 (includes 7.3))
• sysext-incus: xdelta (3.2.0)
• sysext-overlaybd: accelerated-container-image (1.4.4)
• sysext-overlaybd: overlaybd (1.0.18)
• sysext-podman: container-libs (0.69.0)
• sysext-podman: gpgme (2.1.2)
• sysext-python: charset-normalizer (3.4.9)
• sysext-python: distlib (0.4.3)
• sysext-python: jaraco-functools (4.6.0)
• sysext-python: jaraco-text (4.3.0)
• sysext-python: msgpack (1.2.1 (includes 1.2.0))
• sysext-python: packaging (26.3)
• sysext-python: platformdirs (4.10.1)
• sysext-python: pygments (2.20.0)
• sysext-python: setuptools (83.0.0)
• sysext-python: setuptools-scm (10.2.1 (includes 10.1.2, 10.1.1, 10.1.0))
• sysext-python: typing-extensions (4.16.0)
• sysext-python: vcs-versioning (2.2.4 (includes 2.2.2, 2.2.1, 2.2.0, 2.1.0, 2.0.0))
• sysext-zfs: zfs (2.4.4 (includes 2.4.3, 2.4.2, 2.4.1, 2.4.0))

Changes since Alpha 4820.0.1

Security fixes:

• Linux (CVE-2026-98618, CVE-2026-98626, CVE-2026-98625, CVE-2026-98624, CVE-2026-98623, CVE-2026-98622, CVE-2026-98621, CVE-2026-98647, CVE-2026-98646, CVE-2026-98644, CVE-2026-98643, CVE-2026-98642, CVE-2026-98641, CVE-2026-98640, CVE-2026-98620, CVE-2026-98636, CVE-2026-98634, CVE-2026-98632, CVE-2026-98631, CVE-2026-98629, CVE-2026-98573, CVE-2026-98582, CVE-2026-98581, CVE-2026-98580, CVE-2026-98579, CVE-2026-98578, CVE-2026-98615, CVE-2026-98614, CVE-2026-98613, CVE-2026-98577, CVE-2026-98612, CVE-2026-98611, CVE-2026-98610, CVE-2026-98609, CVE-2026-98608, CVE-2026-98607, CVE-2026-98606, CVE-2026-98605, CVE-2026-98576, CVE-2026-98602, CVE-2026-98601, CVE-2026-98600, CVE-2026-98597, CVE-2026-98596, CVE-2026-98594, CVE-2026-98593, CVE-2026-98575, CVE-2026-98591, CVE-2026-98590, CVE-2026-98588, CVE-2026-98586, CVE-2026-98583, CVE-2026-98528, CVE-2026-98537, CVE-2026-98536, CVE-2026-98535, CVE-2026-98534, CVE-2026-98533, CVE-2026-98572, CVE-2026-98569, CVE-2026-98568, CVE-2026-98532, CVE-2026-98567, CVE-2026-98566, CVE-2026-98565, CVE-2026-98561, CVE-2026-98559, CVE-2026-98531, CVE-2026-98555, CVE-2026-98554, CVE-2026-98553, CVE-2026-98550, CVE-2026-98549, CVE-2026-98548, CVE-2026-98547, CVE-2026-98546, CVE-2026-98545, CVE-2026-98544, CVE-2026-98541, CVE-2026-98539, CVE-2026-98538, CVE-2026-98529, CVE-2026-98483, CVE-2026-98491, CVE-2026-98490, CVE-2026-98489, CVE-2026-98488, CVE-2026-98527, CVE-2026-98526, CVE-2026-98525, CVE-2026-98524, CVE-2026-98523, CVE-2026-98487, CVE-2026-98522, CVE-2026-98521, CVE-2026-98519, CVE-2026-98517, CVE-2026-98516, CVE-2026-98515, CVE-2026-98514, CVE-2026-98513, CVE-2026-98486, CVE-2026-98512, CVE-2026-98511, CVE-2026-98510, CVE-2026-98509, CVE-2026-98508, CVE-2026-98507, CVE-2026-98506, CVE-2026-98505, CVE-2026-98504, CVE-2026-98503, CVE-2026-98485, CVE-2026-98502, CVE-2026-98501, CVE-2026-98499, CVE-2026-98498, CVE-2026-98495, CVE-2026-98494, CVE-2026-98493, CVE-2026-98484, CVE-2026-98448, CVE-2026-98482, CVE-2026-98481, CVE-2026-98479, CVE-2026-98477, CVE-2026-98476, CVE-2026-98475, CVE-2026-98473, CVE-2026-98468, CVE-2026-98465, CVE-2026-98464, CVE-2026-98462, CVE-2026-98461, CVE-2026-98460, CVE-2026-98442, CVE-2026-98459, CVE-2026-98457, CVE-2026-98456, CVE-2026-98455, CVE-2026-98454, CVE-2026-98452, CVE-2026-98441, CVE-2026-98435, CVE-2026-98433, CVE-2026-98413, CVE-2026-98412, CVE-2026-98411, CVE-2026-98410, CVE-2026-98409, CVE-2026-98430, CVE-2026-98429, CVE-2026-98428, CVE-2026-98426, CVE-2026-98425, CVE-2026-98407, CVE-2026-98423, CVE-2026-98422, CVE-2026-98421, CVE-2026-98419, CVE-2026-98417, CVE-2026-98416, CVE-2026-98405, CVE-2026-98406, CVE-2026-98403, CVE-2026-98386, CVE-2026-98384, CVE-2026-98383, CVE-2026-98382, CVE-2026-98381, CVE-2026-98380, CVE-2026-98379, CVE-2026-98378, CVE-2026-98377, CVE-2026-98373, CVE-2026-98374, CVE-2026-98360, CVE-2026-98369, CVE-2026-98368, CVE-2026-98367, CVE-2026-98366, CVE-2026-98365, CVE-2026-98363, CVE-2026-98362, CVE-2026-98370, CVE-2026-98322, CVE-2026-98331, CVE-2026-98329, CVE-2026-98328, CVE-2026-98327, CVE-2026-98326, CVE-2026-98359, CVE-2026-98358, CVE-2026-98357, CVE-2026-98354, CVE-2026-98352, CVE-2026-98325, CVE-2026-98351, CVE-2026-98349, CVE-2026-98348, CVE-2026-98862, CVE-2026-98860, CVE-2026-98859, CVE-2026-98858, CVE-2026-98857, CVE-2026-98856, CVE-2026-98855, CVE-2026-98854, CVE-2026-98811, CVE-2026-98809, CVE-2026-98808, CVE-2026-98852, CVE-2026-98807, CVE-2026-98851, CVE-2026-98850, CVE-2026-98849, CVE-2026-98848, CVE-2026-98847, CVE-2026-98846, CVE-2026-98845, CVE-2026-98844, CVE-2026-98841, CVE-2026-98840, CVE-2026-98838, CVE-2026-98837, CVE-2026-98836, CVE-2026-98835, CVE-2026-98833, CVE-2026-98805, CVE-2026-98831, CVE-2026-98830, CVE-2026-98828, CVE-2026-98827, CVE-2026-98826, CVE-2026-98825, CVE-2026-98823, CVE-2026-98822, CVE-2026-98819, CVE-2026-98812, CVE-2026-98752, CVE-2026-98761, CVE-2026-98760, CVE-2026-98758, CVE-2026-98757, CVE-2026-98801, CVE-2026-98798, CVE-2026-98797, CVE-2026-98796, CVE-2026-98794, CVE-2026-98793, CVE-2026-98792, CVE-2026-98756, CVE-2026-98791, CVE-2026-98790, CVE-2026-98785, CVE-2026-98784, CVE-2026-98783, CVE-2026-98782, CVE-2026-98755, CVE-2026-98781, CVE-2026-98780, CVE-2026-98779, CVE-2026-98778, CVE-2026-98777, CVE-2026-98775, CVE-2026-98773, CVE-2026-98772, CVE-2026-98754, CVE-2026-98771, CVE-2026-98770, CVE-2026-98769, CVE-2026-98768, CVE-2026-98767, CVE-2026-98766, CVE-2026-98765, CVE-2026-98764, CVE-2026-98763, CVE-2026-98762, CVE-2026-98753, CVE-2026-98703, CVE-2026-98711, CVE-2026-98710, CVE-2026-98709, CVE-2026-98708, CVE-2026-98751, CVE-2026-98750, CVE-2026-98749, CVE-2026-98748, CVE-2026-98746, CVE-2026-98745, CVE-2026-98744, CVE-2026-98743, CVE-2026-98707, CVE-2026-98742, CVE-2026-98741, CVE-2026-98739, CVE-2026-98738, CVE-2026-98737, CVE-2026-98736, CVE-2026-98735, CVE-2026-98734, CVE-2026-98733, CVE-2026-98706, CVE-2026-98732, CVE-2026-98731, CVE-2026-98730, CVE-2026-98728, CVE-2026-98727, CVE-2026-98726, CVE-2026-98725, CVE-2026-98705, CVE-2026-98722, CVE-2026-98721, CVE-2026-98720, CVE-2026-98717, CVE-2026-98716, CVE-2026-98713, CVE-2026-98704, CVE-2026-98655, CVE-2026-98664, CVE-2026-98663, CVE-2026-98662, CVE-2026-98661, CVE-2026-98660, CVE-2026-98702, CVE-2026-98701, CVE-2026-98700, CVE-2026-98699, CVE-2026-98698, CVE-2026-98697, CVE-2026-98696, CVE-2026-98695, CVE-2026-98694, CVE-2026-98687, CVE-2026-98686, CVE-2026-98658, CVE-2026-98681, CVE-2026-98680, CVE-2026-98679, CVE-2026-98677, CVE-2026-98657, CVE-2026-98673, CVE-2026-98672, CVE-2026-98671, CVE-2026-98670, CVE-2026-98669, CVE-2026-98668, CVE-2026-98666, CVE-2026-98665, CVE-2026-98656, CVE-2026-98440, CVE-2026-98445, CVE-2026-98443, CVE-2026-98458, CVE-2026-98453, CVE-2026-98451, CVE-2026-98450, CVE-2026-99999, CVE-2026-98432, CVE-2026-98260)
• Go (CVE-2026-111943, CVE-2026-56857, CVE-2026-56866, CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78667, CVE-2026-78669, CVE-2026-94439, CVE-2026-94440, CVE-2026-94444, CVE-2026-94447, CVE-2026-94448, CVE-2026-97030, CVE-2026-97031, CVE-2026-97032)
• ca-certificates (CVE-2026-111943)

Bug fixes:

• AWS arm64: Removed bare earlycon from the kernel command line. It took the UART address from the ACPI SPCR table, which is wrong on Graviton, and could hang boot when an NVMe device was mapped at that address, e.g. on t4g instances with an additional EBS volume. (Flatcar#2446)
• STACKIT: Masked systemd-timesyncd.service in the OEM sysext. It conflicts with chronyd.service, and which of the two ended up running after boot depended on timing. (scripts#4318)

Updates:

• Go (1.26.10 (includes 1.26.8, 1.26.9))
• Linux (6.12.113 (includes 6.12.112))
• ca-certificates (3.131.1 (includes 3.131))