Generic Kernel version-release: kernel-6.6.161.1-1
Certificate trust updates
Hardened certificate trust following the eMudhra incident (CVE-2026-114406). Removed or distrusted root certificates that could validate compromised eMudhra intermediate certificates, added intermediate-certificate rejection in Python and Go, and preserved SSL.com TLS trust where needed. Also refreshed Microsoft trusted root certificates.
| Package | Version-release | Certificate change |
|---|---|---|
| ca-certificates | 1:3.0.0-19 | Refresh Microsoft trusted root certificates. |
| golang | 1.27.3-1 | Reject compromised intermediate certificates in crypto/x509 (CVE-2026-111943). |
| grpc | 1.62.3-4 | Remove affected root certificates and preserve SSL.com TLS trust. |
| influxdb | 2.7.5-23 | Remove affected root certificates from the Snowflake bundle and preserve SSL.com TLS trust. |
| mstflint | 4.28.0-3 | Remove affected root certificates and preserve SSL.com TLS trust. |
| nss | 3.96.1-4 | Explicitly distrust affected root certificates. |
| python-pip | 24.2-11 | Remove affected root certificates from the bundled certifi trust store. |
| python-virtualenv | 20.36.1-10 | Remove affected root certificates from embedded pip wheels. |
| python3 | 3.12.16-1 | Reject compromised eMudhra intermediate certificates and remove affected roots from the ensurepip wheel. |
| rubygem-excon | 0.102.0-4 | Remove affected root certificates and preserve SSL.com TLS trust. |
| rubygem-httpclient | 2.8.3-3 | Remove the affected cross-signing root and preserve SSL.com TLS trust. |
| telegraf | 1.31.0-36 | Remove affected root certificates from the Snowflake bundle. |
Other changes
Add kubevirt-openvmm SPEC and GoldenCtr Dockerfiles
Add openvmm patch for confidential support
Backport ukify test fix for newer OpenSSL
Fix containerd2 to handle wrapped ENOTSUP during relabel
Fix dnf5 build failure with expat 2.9.0
Fix golden container tags to use build dates independently of base container versions
Fix grub2 Secure Boot metadata by raising SBAT to grub,6
Fix kernel to allow co-installation with kernel-hwe
Fix kernel to expose read-only Btrfs backing to IPE
Fix ptest failures in eight Python packages by pinning packaging to 23.2
Fix python-virtualenv security backports and development test reconciliation
Fix python-virtualenv test bootstrap while preserving RPM-owned packaging
Fix systemd: backport sd-event fix for hang after ratelimit expiry
Patch alsa-lib for CVE-2026-90781, CVE-2026-96674, CVE-2026-96675
Patch application-gateway-kubernetes-ingress for CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-97032
Patch aspell for CVE-2026-103658, CVE-2026-75818, CVE-2026-75819, CVE-2026-75820
Patch avahi for CVE-2024-52615
Patch azcopy for CVE-2026-78660, CVE-2026-78669
Patch binutils for CVE-2026-91781
Patch bluez for CVE-2026-19774
Patch busybox for CVE-2026-88835
Patch cert-manager for CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-81870, CVE-2026-92543, CVE-2026-97032
Patch cf-cli for CVE-2026-78660, CVE-2026-78669
Patch cloud-provider-kubevirt for CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-97032
Patch conda for CVE-2026-53940
Patch containerized-data-importer for CVE-2026-61801, CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-97032
Patch coredns for CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-82399, CVE-2026-86003, CVE-2026-97032
Patch cri-tools for CVE-2026-78660, CVE-2026-78669, CVE-2026-84304, CVE-2026-84445
Patch cups for CVE-2026-87875
Patch curl for CVE-2026-13608, CVE-2026-18924, CVE-2026-19931, CVE-2026-80230
Patch docker-buildx for CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-81870, CVE-2026-84304, CVE-2026-84445, CVE-2026-92543, CVE-2026-97032
Patch docker-cli for CVE-2026-78669, CVE-2026-92543
Patch docker-compose for CVE-2026-61801, CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-81870, CVE-2026-84304, CVE-2026-84445, CVE-2026-92543, CVE-2026-97032
Patch edk2 for CVE-2026-35189, CVE-2026-54872, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782
Patch emacs for CVE-2026-96269, CVE-2026-96442
Patch erlang for CVE-2026-105236, CVE-2026-65634, CVE-2026-68956, CVE-2026-89422, CVE-2026-94200
Patch flannel for CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-81870, CVE-2026-84304, CVE-2026-84445, CVE-2026-97032
Patch fluent-bit for CVE-2026-61674
Patch freetype for CVE-2026-95512
Patch git-lfs for CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-97032
Patch glib-networking for CVE-2026-103963
Patch gnuplot for CVE-2025-31176, CVE-2025-31180, CVE-2025-31181
Patch guava for CVE-2026-102554
Patch haproxy for CVE-2026-110354
Patch hdf5 for CVE-2025-2308, CVE-2025-2309, CVE-2026-106547, CVE-2026-19025, CVE-2026-19026
Patch ignition-flatcar for CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-97032
Patch influxdb for CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-82458, CVE-2026-97032
Patch iperf3 for CVE-2026-102253
Patch javapackages-bootstrap for CVE-2026-71497
Patch jx for CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-97032
Patch kata-containers for CVE-2026-107324, CVE-2026-107325, CVE-2026-61801, CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-81870, CVE-2026-97032
Patch kata-containers-cc for CVE-2026-107324, CVE-2026-42784, CVE-2026-63772, CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-81870, CVE-2026-93599, CVE-2026-93600, CVE-2026-93601, CVE-2026-93602, CVE-2026-94637, CVE-2026-97032
Patch krb5 for CVE-2026-107778
Patch kube-vip-cloud-provider for CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-81870, CVE-2026-97032
Patch kubernetes for CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-97032
Patch kubevirt for CVE-2026-107324, CVE-2026-107325, CVE-2026-61801, CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-84304, CVE-2026-84445, CVE-2026-93450, CVE-2026-97032
Patch kured for CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-97032
Patch libical for CVE-2026-111269, CVE-2026-88383
Patch libnfs for CVE-2026-108985
Patch libreswan for CVE-2026-77207, CVE-2026-94453
Patch librsvg2 for CVE-2026-96889
Patch libsndfile for CVE-2025-52194, CVE-2026-88386
Patch libsoup for CVE-2026-102555, CVE-2026-102556, CVE-2026-102557, CVE-2026-102558, CVE-2026-102560, CVE-2026-77014, CVE-2026-85197
Patch libvirt for CVE-2026-77159
Patch moby-containerd-cc for CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-81870, CVE-2026-84304, CVE-2026-84445, CVE-2026-97032
Patch moby-engine for CVE-2026-37236, CVE-2026-56855, CVE-2026-78662, CVE-2026-84304, CVE-2026-84445
Patch multus for CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-97032
Patch nfs-utils for CVE-2026-89098
Patch nmap for CVE-2026-89157, CVE-2026-89160
Patch ntopng for CVE-2026-38968
Patch opa for CVE-2026-78659, CVE-2026-97032
Patch opensc for CVE-2026-103531
Patch openssl for CVE-2026-35189, CVE-2026-42772, CVE-2026-54872, CVE-2026-54873, CVE-2026-54875, CVE-2026-72897, CVE-2026-75804, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782, CVE-2026-84784
Patch packer for CVE-2026-107324, CVE-2026-107325, CVE-2026-19585, CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-97032
Patch perl for CVE-2026-82560
Patch popt for CVE-2026-18743
Patch prometheus-adapter for CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-97032
Patch prometheus-node-exporter for CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-97032
Patch prometheus-process-exporter for CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-97032
Patch python-oauthlib for CVE-2026-49264, CVE-2026-49265
Patch python-twisted for CVE-2026-106454
Patch python-urllib3 for CVE-2026-97689
Patch python-virtualenv for CVE-2026-102925, CVE-2026-102930
Patch qemu for CVE-2026-81627, CVE-2026-93834
Patch qtbase for CVE-2026-78253
Patch qtdeclarative for CVE-2026-79616
Patch rabbitmq-server for CVE-2026-43969, CVE-2026-66071, CVE-2026-66076, CVE-2026-67223, CVE-2026-67224, CVE-2026-67227, CVE-2026-67230, CVE-2026-67231, CVE-2026-67404, CVE-2026-67409, CVE-2026-67411, CVE-2026-67412, CVE-2026-67418, CVE-2026-67419, CVE-2026-67420, CVE-2026-67421
Patch rsync for CVE-2026-18743
Patch runc for CVE-2026-61801
Patch skopeo for CVE-2026-107324, CVE-2026-107325, CVE-2026-61801, CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-97032
Patch sos for CVE-2026-79655
Patch squid for CVE-2026-61642
Patch sriov-network-device-plugin for CVE-2026-78660, CVE-2026-78669
Patch sudo for CVE-2026-96512
Patch tar for CVE-2026-5704
Patch telegraf for CVE-2026-107324, CVE-2026-107325, CVE-2026-61801, CVE-2026-63772, CVE-2026-66055, CVE-2026-77403, CVE-2026-77405, CVE-2026-77406, CVE-2026-77407, CVE-2026-77408, CVE-2026-77409, CVE-2026-77410, CVE-2026-77411, CVE-2026-77412, CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-82458, CVE-2026-83663, CVE-2026-94637, CVE-2026-97032
Patch util-linux for CVE-2026-53612, CVE-2026-53613, CVE-2026-53614, CVE-2026-53615
Patch vitess for CVE-2026-104252, CVE-2026-63772, CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-94637, CVE-2026-97032
Patch zlib for CVE-2026-76844
Remove KEDA from Azure Linux
Upgrade afflib to 3.7.23 for CVE-2026-119601
Upgrade azurelinux-image-tools to v1.7.0 for CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-97032
Upgrade bind to 9.20.30 for CVE-2026-94300
Upgrade brotli to 1.2.1-1 for Broccoli2Shell CVE-2026-111497
Upgrade c-ares to 1.34.8 for CVE-2026-69184, CVE-2026-69186
Upgrade cifs-utils to 7.9 for CVE-2026-104715
Upgrade containerd2 to 2.3.7 for CVE-2026-53493, CVE-2026-53495, CVE-2026-61801, CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-81870, CVE-2026-95838, CVE-2026-95839, CVE-2026-97032
Upgrade dpdk to 23.11.8 for CVE-2026-100236, CVE-2026-86562, CVE-2026-86564, CVE-2026-86565, CVE-2026-86567
Upgrade environment-modules to 5.3.2 for CVE-2026-85013
Upgrade etcd to 3.5.35 for CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-84304, CVE-2026-84445, CVE-2026-97032
Upgrade expat to 2.9.0 for CVE-2026-102633, CVE-2026-77214, CVE-2026-93990
Upgrade frr to 10.5.5 follow-up complete fix for CVE-2016-4049
Upgrade gh to 2.102.0 for CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-97032, GHSA-39wj-f2f4-978v, GHSA-4mq3-hpgx-9cx8, GHSA-qcwj-mr2r-2cx7, GHSA-wjmr-j3rp-mh2g
Upgrade golang to 1.27.3-1
Upgrade httpd to 2.4.69 for CVE-2026-57941, CVE-2026-59685, CVE-2026-63292
Upgrade kata-containers to 4.1.0.kata1
Upgrade kernel to 6.6.161.1. Note PwnEscape (CVE-2026-99999) was fixed starting from kernel 6.6.159.1-1.
Upgrade kernel-hwe to 6.18.57.1
Upgrade kernel-mshv to 6.18.58.mshv2
Upgrade kernel-uvm to 6.18.52.mshv1
Upgrade libX11 to 1.8.14 & libXrender to 0.9.13 for CVE-2026-88806, CVE-2026-88807, CVE-2026-94283, CVE-2026-94284, CVE-2026-94285
Upgrade libXi to 1.8.4 for CVE-2026-93541, CVE-2026-93542, CVE-2026-93543, CVE-2026-93544, CVE-2026-93545, CVE-2026-94281, CVE-2026-94282
Upgrade libXpm to 3.5.20 for CVE-2026-94287
Upgrade libXtst to 1.2.6 for CVE-2026-109088, CVE-2026-94286
Upgrade libslirp to 4.9.6 for CVE-2026-115449, CVE-2026-95508
Upgrade moby-engine to 25.0.18
Upgrade nginx to 1.30.6 for CVE-2026-101019, CVE-2026-101025, CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97205, CVE-2026-97629
Upgrade nodejs to 24.22.1 CVE-2026-16729
Upgrade objectweb-asm to 9.11.1 for CVE-2026-110257, CVE-2026-110258, CVE-2026-110260, CVE-2026-110261, CVE-2026-110262, CVE-2026-110263, CVE-2026-110270, CVE-2026-110591
Upgrade openvmm to 0.4.0
Upgrade perl-DBI to 1.655 for CVE-2026-108518, CVE-2026-111879, CVE-2026-78030, CVE-2026-88815, CVE-2026-88816
Upgrade pgbouncer to 1.26.1 for CVE-2026-107348, CVE-2026-107349, CVE-2026-107350, CVE-2026-19888, CVE-2026-6668, CVE-2026-6669
Upgrade php to 8.3.36 for CVE-2025-1218, CVE-2025-14181, CVE-2026-6103, CVE-2026-91765, CVE-2026-91766, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-92842, CVE-2026-93682. Note that PHP 8.3.35-2 or greater has CVE-2026-109618 and CVE-2026-109619 the PHP2Shell remote-code-execution fixes.
Upgrade python-jwt to 2.15.1 for CVE-2026-101917, CVE-2026-102267, CVE-2026-102268, CVE-2026-102269, CVE-2026-102270
Upgrade python-msgpack to 1.2.3 for CVE-2026-114613
Upgrade python3 to 3.12.16 for CVE-2024-3220, CVE-2026-114583, CVE-2026-12345, CVE-2026-17084
Upgrade ruby to 3.3.13 for CVE-2026-110264, CVE-2026-89078, CVE-2026-93577, CVE-2026-97229
Upgrade rust to 1.98.1
Upgrade thrift to 0.25.0 for CVE-2026-82458, CVE-2026-82459, CVE-2026-85087, CVE-2026-85494, CVE-2026-91135, CVE-2026-92834, CVE-2026-93925, CVE-2026-93926, CVE-2026-94634, CVE-2026-94636, CVE-2026-94652
Upgrade trident to 0.30.0
Upgrade tzdata to 2026f
Upgrade unbound to 1.26.2 for CVE-2026-109125, CVE-2026-35501, CVE-2026-50106, CVE-2026-96405, CVE-2026-97206
Upgrade valkey to 8.0.12 for GHSA-f4q9-j22m-xqq9
Upgrade vim to 9.2.1244
Upgrade wpa_supplicant to 2.12 for CVE-2026-78807
Upgrade xorg-x11-server-Xwayland to 24.1.14 for CVE-2026-88812, CVE-2026-93515, CVE-2026-93516, CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520, CVE-2026-93521, CVE-2026-93522, CVE-2026-93523, CVE-2026-93524, CVE-2026-93536
Upgrade zchunk to 1.5.5 for CVE-2026-117556