Flatcar Container Linux

stable-4757.2.0Provisioning & Runtime

Sep 14, 2026

A security-focused maintenance release with extensive Linux and OpenSSH vulnerability remediation, broad dependency updates, and platform and image changes. Operators should account for the dropped platform and image support and the new Vagrant 2.2.5 requirement.

Action needed (41)

securitycriticalcontainerd vulnerability remediation
containerd is updated with remediation for CVE-2026-47262, CVE-2026-50195, CVE-2026-53488, CVE-2026-53489, and CVE-2026-53492.
securitycriticalgo vulnerability remediation
go is updated with remediation for the listed vulnerabilities, including CVE-2025-61726, CVE-2025-61727, and CVE-2025-61728.
securityhighbind vulnerability remediation
bind is updated with remediation for CVE-2025-40778, CVE-2025-40780, and CVE-2025-8677.
securityhighglib vulnerability remediation
glib is updated with remediation for CVE-2025-13601 and CVE-2025-14087.
securityhighglibc vulnerability remediation
glibc is updated with remediation for CVE-2025-15281, CVE-2026-0861, and CVE-2026-0915.
securityhighgnutls vulnerability remediation
gnutls is updated with remediation for the listed vulnerabilities, including CVE-2025-14831, CVE-2025-9820, and CVE-2026-1584.
securityhighincus vulnerability remediation
incus is updated with remediation for CVE-2026-23953.
securityhighlibtasn1 vulnerability remediation
libtasn1 is updated with remediation for CVE-2025-13151.
securityhighnvidia-drivers vulnerability remediation
nvidia-drivers is updated with remediation for the listed vulnerabilities, including CVE-2025-33219, CVE-2025-33221, and CVE-2026-24182.
securityhighpodman vulnerability remediation
podman is updated with remediation for CVE-2025-52881 and CVE-2025-9566.
securityhighsssd vulnerability remediation
sssd is updated with remediation for CVE-2025-11561 and CVE-2026-6245.
securityhighurllib3 vulnerability remediation
urllib3 is updated with remediation for CVE-2025-66418 and CVE-2025-66471.
securityhighopenssh vulnerability remediation
openssh is updated with remediation for CVE-2026-59995, CVE-2026-59996, CVE-2026-59997, CVE-2026-59998, CVE-2026-59999, CVE-2026-60000, CVE-2026-60001, and CVE-2026-60002.
securitymediumc-ares vulnerability remediation
c-ares is updated with remediation for CVE-2025-62408.
securityhighcurl vulnerability remediation
curl is updated with remediation for CVE-2025-13034, CVE-2025-14017, CVE-2025-14524, CVE-2025-14819, CVE-2025-15079, CVE-2025-15224, CVE-2026-1965, CVE-2026-3783, CVE-2026-3784, and CVE-2026-3805.
securitymediumlibarchive vulnerability remediation
libarchive is updated with remediation for CVE-2025-60753 and CVE-2026-4426.
securitymediumlibxml2 vulnerability remediation
libxml2 is updated with remediation for CVE-2026-0989, CVE-2026-0990, CVE-2026-0992, and CVE-2026-1757.
securitymediumlibxslt vulnerability remediation
libxslt is updated with remediation for CVE-2025-10911 and CVE-2025-11731.
securitymediump11-kit vulnerability remediation
p11-kit is updated with remediation for CVE-2026-2100.
securityhighrsync vulnerability remediation
rsync is updated with remediation for the listed vulnerabilities, including CVE-2025-10158, CVE-2026-29518, and CVE-2026-41035.
securitymediumutil-linux vulnerability remediation
util-linux is updated with remediation for CVE-2025-14104 and CVE-2026-27456.
securitylowintel-microcode vulnerability remediation
intel-microcode is updated with remediation for CVE-2025-31648.
securitylowlibpcap vulnerability remediation
libpcap is updated with remediation for CVE-2025-11961 and CVE-2025-11964.
securitycriticalLinux vulnerability remediation
Linux is updated with remediation for the listed vulnerabilities, including CVE-2026-80888 and the other advisories recorded for this change.
securityhighbubblewrap vulnerability remediation
bubblewrap is updated with remediation for CVE-2026-41163.
securitymediumexpat vulnerability remediation
expat is updated with remediation for CVE-2026-24515, CVE-2026-25210, CVE-2026-32776, CVE-2026-32777, CVE-2026-32778, CVE-2026-41080, and CVE-2026-45186.
securityhighgnupg vulnerability remediation
gnupg is updated with remediation for CVE-2026-24881, CVE-2026-24882, and CVE-2026-24883.
securitymediumlibcap vulnerability remediation
libcap is updated with remediation for CVE-2026-4878.
securitymediumlibgcrypt vulnerability remediation
libgcrypt is updated with remediation for CVE-2026-41989.
securityhighopenssh vulnerability remediation
openssh is updated with remediation for CVE-2026-35385, CVE-2026-35386, CVE-2026-35387, CVE-2026-35388, and CVE-2026-35414.
securitycriticalopenssl vulnerability remediation
openssl is updated with remediation for the listed vulnerabilities, including CVE-2026-2673, CVE-2026-28386, and CVE-2026-28387.
securitylowrunc vulnerability remediation
runc is updated with remediation for CVE-2026-41579.
securitymediumsystemd vulnerability remediation
systemd is updated with remediation for CVE-2026-40223, CVE-2026-40225, and CVE-2026-40226.
securitylowxz-utils vulnerability remediation
xz-utils is updated with remediation for CVE-2026-34743.
securitylowzlib vulnerability remediation
zlib is updated with remediation for CVE-2026-27171.
breakingEquinix Metal (Packet) support removal
Support for Equinix Metal (Packet) is dropped.
breakingRackspace support removal
Support for Rackspace, including OnMetal, is dropped.
breakingThe Oklo release codename, removed
The Oklo release codename is dropped.
breakingVMware "insecure" image removal
The VMware "insecure" image is dropped.
breakingVagrant VirtualBox image removal
The Vagrant VirtualBox image is dropped.
breakingVagrant 2.2.5 requirement
Vagrant 2.2.5 is now required.

All 56 other recorded changesvalue changes 46 · additions 5 · constraints 2 · fixes 2 · renames 1

value changes (46)

images are now built as 10G .qcow2
Build AMD GPU driver as module
Moved systemd-sysext image mounting into the initrd
OS-dependent sysexts (e.g., docker-flatcar, containerd-flatcar, podman, zfs, nvidia) are now cryptographically signed using dm-verity roothash signatures.
VMs are configured with modern hardware, including a VirtIO storage controller and UEFI.
Reworked how the OEM partition is mounted at boot time
Switched /etc/ from a custom overlayfs for A/B updates to using a systemd-confext extension
- Linux ([6.12.109]
- Linux Firmware ([20260519]
python ([3.12.13_p1]
urllib3 ([2.7.0]
adcli ([0.9.3.1]
audit ([4.1.4]
bash ([5.3_p9]
bind ([9.18.42]
binutils-config ([5.6]
binutils-libs ([2.46.0]
bpftool ([7.7.0]
btrfs-progs ([6.19.1]
c-ares ([1.34.6]
checkpolicy ([3.9]
cifs-utils ([7.5]
conntrack-tools ([1.4.9]
coreutils ([9.11]
cri-tools ([1.33.0]
cryptsetup ([2.8.6]
curl ([8.19.0]
dracut ([110]
e2fsprogs ([1.47.4]
elfutils ([0.195]
ethtool ([6.19]
expat ([2.8.1]
gentoo-functions ([1.7.6]
git ([2.53.0]
glibc ([2.42]
gnupg ([2.5.18]
gnutls ([3.8.13]
hwdata ([0.401]
intel-microcode ([20260512_p20260513]
iproute2 ([6.19.0]
iptables ([1.8.13]
kexec-tools ([2.0.32]
less ([692]
libarchive ([3.8.7]
libcap ([2.78]
libcap-ng ([0.9.3]

additions (5)

Added full terminfo database to support modern terminals like foot and Alacritty.
Add EROFS tools for containerd
Added Oracle Cloud Infrastructure images
Enable VNC console serial logs on ARM64 QEMU/KVM instances
enable /dev/kfd/ in amdgpu driver on AMD64

constraints (2)

Updated the GCE udev disk rules to include NVMe disks.
Added kernel config options to support HuC firmware authentication

fixes (2)

Fixed booting the VirtualBox image
Fixed using Ignition to create new partitions with number 0

renames (1)

All the legacy OEMs (CloudSigma, CloudStack, Exoscale, Vagrant, VirtualBox) have been converted to sysexts.

Add Flatcar Container Linux to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →

Official release note ↗All Flatcar Container Linux releases →