containerd
v2.2.3Kubernetes Corecontainerd v2.2.3 patches CVE-2026-35469 in spdystream and fixes several bugs including whiteout handling in parallel unpacks, TOCTOU race in tar extraction, and Go 1.24 symlink regressions.
securityPatch CVE-2026-35469: upgrade to v2.2.3 now
CVE-2026-35469 affects moby/spdystream, which containerd uses for streaming connections. The fix is in spdystream v0.5.1, bundled in this release. If you're running any 2.2.x version, treat this as a mandatory upgrade — don't wait for your next maintenance window.
breakingParallel unpack whiteout bug could mean corrupted layer state — verify images
A bug caused whiteout files (which signal file deletions between layers) to be ignored when parallel unpack was enabled. If you've been using parallel unpack with overlayfs, layer deletion semantics may not have applied correctly. After upgrading, re-pull any images that were unpacked in parallel to ensure their layer state is consistent.
enhancementGo 1.24 users on NixOS or symlink-heavy rootfs: this fixes your container startup failures
Absolute symlink handling in rootfs user/group lookups regressed with Go 1.24. This affected systems where /etc/passwd or /etc/group are symlinks (common on NixOS-style setups). If you've seen user lookup failures or container start errors after moving to Go 1.24-built binaries, upgrading to v2.2.3 resolves this.
主な変更 (5)
- Security patch for CVE-2026-35469 via spdystream upgrade to v0.5.1
- Fixed whiteouts being silently ignored during parallel unpack — critical for image correctness
- TOCTOU race condition hardened in tar extraction path
- runc updated to v1.3.5
- Absolute symlink resolution fixed for /etc/passwd and /etc/group lookups, addressing Go 1.24 regressions on NixOS-style and similar systems