A broad operator-facing release with fixes, behavior changes, new capabilities, API and feature-gate maturity changes, deprecations, and component updates. It also includes security updates for CVE-2026-35469, GHSA-pc3f-x583-g7j2, and CVE-2026-33186, along with a symlink-traversal fix and a security dependency update.
Action needed (2)
securitycriticalThe
grpcdependency, updatedgrpcis updated to 1.79.3 to remediate CVE-2026-33186.securityhighThe
github.dependency, updatedcom/moby/spdystream The
github.dependency is updated from v0.5.0 to v0.5.1 to address CVE-2026-35469 (GHSA-pc3f-x583-g7j2).com/moby/spdystream
Check if affected (9)
breakingStricter network interface binding admission
Applies if you configure network interface bindings.
Admission now rejects interfaces with no binding or multiple bindings instead of allowing them to fail silently at runtime.
breakingThe
Templatefeature gate, enabled by defaultApplies if you enable the
Templatefeature gate.The
Templatefeature gate has graduated to Beta and is enabled by default. Virt-template components are deployed automatically unless explicitly disabled.breakingThe ephemeral hotplug volume metric and alert, removed
Applies if you use the ephemeral hotplug volume metric.
The ephemeral hotplug volume metric and alert have been removed.
- + 6 more on the release page
Plan ahead (2)
deprecatedcgroup v1 support, deprecatedremoval date not announced
Applies if you run with cgroup v1 support.
cgroup v1 support is deprecated, with removal planned for the next release.
deprecatedLegacy VM creation recording rules and metrics, deprecated
Applies if you use
kubevirt_vm_created_totalorkubevirt_vm_created_by_pod_total.Multiple recording rules are deprecated in favor of new names to comply with recording rule naming conventions. The
kubevirt_vm_created_totalrecording rule andkubevirt_vm_created_by_pod_totalmetric are deprecated completely.