AI-analyzed release notes for CNCF graduated and incubating projects.
This is primarily a security-focused Flatcar release with a large set of disclosed Linux fixes. It also includes a QEMU launcher performance correction and updates to Linux and ca-certificates dependencies.
Action needed (1)
securitycriticalLinux security fixes
Linux is updated with fixes for the disclosed advisories, including CVE-2023-52435, the CVE-2025-* and CVE-2026-* advisories listed for this release. The fixes ship in Flatcar lts-4081..
A security- and maintenance-focused release with Linux and bundled-component security updates, dependency updates, and corrections for minimal-initrd regressions. It also changes overlaybd service startup, OpenSSH defaults, kernel module availability in the first initrd, and other operator-visible behavior and layout.
Action needed (18)
securitycriticalLinux security updates
Linux receives security updates for the listed advisories, including CVE-2024-56757 and CVE-2026-31788.
securityhighcurl security updates
curl receives security updates for CVE-2025-10148 and CVE-2025-9086.
securityhighexpat security update
expat receives a security update for CVE-2025-59375.
securityhighgnupg security updates
gnupg receives security updates for CVE-2025-68972 and CVE-2025-68973.
securityhighGo security updates
go receives security updates for CVE-2025-47910, CVE-2025-47912, CVE-2025-58183, CVE-2025-58185, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, and CVE-2025-61725.
securityhighIntel microcode security updates
intel-microcode receives security updates for CVE-2024-28956, CVE-2024-43420, CVE-2024-45332, CVE-2025-20012, CVE-2025-20053, CVE-2025-20054, CVE-2025-20103, CVE-2025-20109, CVE-2025-20623, CVE-2025-22839, CVE-2025-22840, CVE-2025-22889, CVE-2025-24495, and CVE-2025-26403.
securityhighlibxslt security updates
libxslt receives security updates for CVE-2025-7424 and CVE-2025-7425.
securityhighNVIDIA driver security updates
nvidia-drivers receives security updates for CVE-2025-23280, CVE-2025-23282, CVE-2025-23300, CVE-2025-23330, CVE-2025-23332, and CVE-2025-23345.
securityhighOpenSSL security updates
openssl receives security updates for CVE-2025-9230, CVE-2025-9231, and CVE-2025-9232.
securityhighPAM security updates
pam receives security updates for CVE-2024-10041, CVE-2024-10963, CVE-2024-22365, and CVE-2025-6020.
securitymediumbinutils security updates
binutils receives security updates for CVE-2025-5244, CVE-2025-5245, and CVE-2025-8225.
securitymediumcoreutils security update
coreutils receives a security update for CVE-2025-5278.
securitymediumlibpcre2 security update
libpcre2 receives a security update for CVE-2025-58050.
securitymediumnet-tools security update
net-tools receives a security update for CVE-2025-46836.
securitylowOpenSSH security updates
openssh receives security updates for CVE-2025-61984 and CVE-2025-61985.
securitylibxml2 update
libxml2 is updated to the version shown in the release note, libxml2-20250908.
breakingOpenSSH upstream defaults
Ciphers, MACs, and KexAlgorithms are removed from the sshd configuration, so the OpenSSH upstream defaults are used.
breakingReduced first-stage initrd kernel modules
The set of kernel modules available in the first stage initrd is reduced.
Check if affected (1)
breakingAutomatic startup for overlaybd sysext services
Applies if you use the overlaybd sysext.
This release fixes an HFC controller error loop, removes unused RBAC permissions, and updates project dependencies. The changes cover controller correctness and routine maintenance, with no stated security advisory.
Action needed (1)
breakingUnused permissions in the controller ClusterRole removed
Unused RBAC permissions are removed from the controller ClusterRole.
This release removes unused controller permissions and includes fixes and dependency updates. It may concern users tracking HFC controller behavior, CAPI, the Kubernetes group, or the Go build toolchain.
Action needed (1)
breakingUnused controller ClusterRole RBAC permissions removed
Unused RBAC permissions are removed from the controller ClusterRole in this release.
