From 351660b084b100d65472823bcebd52845430768e Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Mon, 3 Aug 2026 18:39:04 +0000 Subject: [PATCH 1/3] Patch kata-containers-cc for CVE-2026-55969, CVE-2026-48586, CVE-2026-43871 --- SPECS/kata-containers-cc/CVE-2026-43871.patch | 51 ++++++ SPECS/kata-containers-cc/CVE-2026-48586.patch | 148 ++++++++++++++++ SPECS/kata-containers-cc/CVE-2026-55969.patch | 163 ++++++++++++++++++ .../kata-containers-cc.spec | 8 +- 4 files changed, 369 insertions(+), 1 deletion(-) create mode 100644 SPECS/kata-containers-cc/CVE-2026-43871.patch create mode 100644 SPECS/kata-containers-cc/CVE-2026-48586.patch create mode 100644 SPECS/kata-containers-cc/CVE-2026-55969.patch diff --git a/SPECS/kata-containers-cc/CVE-2026-43871.patch b/SPECS/kata-containers-cc/CVE-2026-43871.patch new file mode 100644 index 00000000000..2c44490dfb1 --- /dev/null +++ b/SPECS/kata-containers-cc/CVE-2026-43871.patch @@ -0,0 +1,51 @@ +From 30a34feb076d3f7980a3ee7498e3c9da25382368 Mon Sep 17 00:00:00 2001 +From: AllSpark +Date: Mon, 3 Aug 2026 18:23:26 +0000 +Subject: [PATCH] Add varint byte-count limit to compact protocol reader + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: AI Backport of https://github.com/apache/thrift/commit/d5152211af61f850ec393604316804096dd4632e.patch +--- + .../thrift/lib/go/thrift/compact_protocol.go | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/compact_protocol.go b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/compact_protocol.go +index a49225d..3e1988c 100644 +--- a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/compact_protocol.go ++++ b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/compact_protocol.go +@@ -754,25 +754,28 @@ func (p *TCompactProtocol) readVarint32() (int32, error) { + return int32(v), err + } + ++// maxVarint64Bytes is the maximum wire size of a varint-encoded 64-bit integer: ++// ceil(64/7) = 10 bytes, matching the protobuf wire-format specification. ++const maxVarint64Bytes = 10 ++ + // Read an i64 from the wire as a proper varint. The MSB of each byte is set + // if there is another byte to follow. This can read up to 10 bytes. + func (p *TCompactProtocol) readVarint64() (int64, error) { + shift := uint(0) + result := int64(0) +- for { ++ for rsize := 0; rsize < maxVarint64Bytes; rsize++ { + b, err := p.readByteDirect() + if err != nil { + return 0, err + } + result |= int64(b&0x7f) << shift + if (b & 0x80) != 0x80 { +- break ++ return result, nil + } + shift += 7 + } +- return result, nil ++ return 0, NewTProtocolExceptionWithType(INVALID_DATA, errors.New("variable-length int over 10 bytes")) + } +- + // Read a byte, unlike ReadByte that reads Thrift-byte that is i8. + func (p *TCompactProtocol) readByteDirect() (byte, error) { + return p.trans.ReadByte() +-- +2.45.4 + diff --git a/SPECS/kata-containers-cc/CVE-2026-48586.patch b/SPECS/kata-containers-cc/CVE-2026-48586.patch new file mode 100644 index 00000000000..17267c8150d --- /dev/null +++ b/SPECS/kata-containers-cc/CVE-2026-48586.patch @@ -0,0 +1,148 @@ +From 5fabe062a1881923a08032fd5cf53e25f94e5c6b Mon Sep 17 00:00:00 2001 +From: AllSpark +Date: Mon, 3 Aug 2026 18:23:10 +0000 +Subject: [PATCH] Add decompressed data size limit to TZlibTransport Client: go + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: AI Backport of https://github.com/apache/thrift/commit/aed9eb012c76d3d59618cbdc225c65f013ce3ab0.patch +--- + .../thrift/lib/go/thrift/zlib_transport.go | 23 +++++-- + .../lib/go/thrift/zlib_transport_test.go | 64 +++++++++++++++++++ + 2 files changed, 83 insertions(+), 4 deletions(-) + create mode 100644 src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/zlib_transport_test.go + +diff --git a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/zlib_transport.go b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/zlib_transport.go +index 259943a..328c704 100644 +--- a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/zlib_transport.go ++++ b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/zlib_transport.go +@@ -22,6 +22,7 @@ package thrift + import ( + "compress/zlib" + "context" ++ "fmt" + "io" + ) + +@@ -33,9 +34,11 @@ type TZlibTransportFactory struct { + + // TZlibTransport is a TTransport implementation that makes use of zlib compression. + type TZlibTransport struct { +- reader io.ReadCloser +- transport TTransport +- writer *zlib.Writer ++ reader io.ReadCloser ++ transport TTransport ++ writer *zlib.Writer ++ conf *TConfiguration ++ bytesRead int64 + } + + // GetTransport constructs a new instance of NewTZlibTransport +@@ -78,6 +81,7 @@ func NewTZlibTransport(trans TTransport, level int) (*TZlibTransport, error) { + // Close closes the reader and writer (flushing any unwritten data) and closes + // the underlying transport. + func (z *TZlibTransport) Close() error { ++ z.bytesRead = 0 + if z.reader != nil { + if err := z.reader.Close(); err != nil { + return err +@@ -116,7 +120,17 @@ func (z *TZlibTransport) Read(p []byte) (int, error) { + z.reader = r + } + +- return z.reader.Read(p) ++ n, err := z.reader.Read(p) ++ if n > 0 { ++ z.bytesRead += int64(n) ++ if maxSize := int64(z.conf.GetMaxMessageSize()); z.bytesRead > maxSize { ++ return n, NewTProtocolExceptionWithType( ++ SIZE_LIMIT, ++ fmt.Errorf("decompressed size exceeded limit of %d bytes", maxSize), ++ ) ++ } ++ } ++ return n, err + } + + // RemainingBytes returns the size in bytes of the data that is still to be +@@ -131,6 +145,7 @@ func (z *TZlibTransport) Write(p []byte) (int, error) { + + // SetTConfiguration implements TConfigurationSetter for propagation. + func (z *TZlibTransport) SetTConfiguration(conf *TConfiguration) { ++ z.conf = conf + PropagateTConfiguration(z.transport, conf) + } + +diff --git a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/zlib_transport_test.go b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/zlib_transport_test.go +new file mode 100644 +index 0000000..191b6b9 +--- /dev/null ++++ b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/zlib_transport_test.go +@@ -0,0 +1,64 @@ ++/* ++ * Licensed to the Apache Software Foundation (ASF) under one ++ * or more contributor license agreements. See the NOTICE file ++ * distributed with this work for additional information ++ * regarding copyright ownership. The ASF licenses this file ++ * to you under the Apache License, Version 2.0 (the ++ * "License"); you may not use this file except in compliance ++ * with the License. You may obtain a copy of the License at ++ * ++ * http://www.apache.org/licenses/LICENSE-2.0 ++ * ++ * Unless required by applicable law or agreed to in writing, ++ * software distributed under the License is distributed on an ++ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY ++ * KIND, either express or implied. See the License for the ++ * specific language governing permissions and limitations ++ * under the License. ++ */ ++ ++package thrift ++ ++import ( ++\t"bytes" ++\t"compress/zlib" ++\t"context" ++\t"testing" ++) ++ ++func TestZlibTransportMessageSizeLimit(t *testing.T) { ++\tconst dataSize = 4096 ++\tdata := bytes.Repeat([]byte{'a'}, dataSize) ++ ++\t// Write and flush (not close) so TMemoryBuffer.Close() doesn't wipe the data. ++\twriteBuf := NewTMemoryBuffer() ++\twriter, err := NewTZlibTransport(writeBuf, zlib.BestCompression) ++\tif err != nil { ++\t\tt.Fatal(err) ++\t} ++\tif _, err := writer.Write(data); err != nil { ++\t\tt.Fatal(err) ++\t} ++\tif err := writer.Flush(context.Background()); err != nil { ++\t\tt.Fatal(err) ++\t} ++\tcompressed := make([]byte, writeBuf.Len()) ++\tcopy(compressed, writeBuf.Bytes()) ++ ++\treadBuf := NewTMemoryBuffer() ++\treadBuf.Write(compressed) ++\treader, err := NewTZlibTransport(readBuf, zlib.BestCompression) ++\tif err != nil { ++\t\tt.Fatal(err) ++\t} ++\treader.SetTConfiguration(&TConfiguration{MaxMessageSize: 1024}) ++ ++\t_, err = reader.Read(make([]byte, dataSize)) ++\tif err == nil { ++\t\tt.Fatal("expected SIZE_LIMIT error, got nil") ++\t} ++\tprotoEx, ok := err.(TProtocolException) ++\tif !ok || protoEx.TypeId() != SIZE_LIMIT { ++\t\tt.Fatalf("expected SIZE_LIMIT TProtocolException, got %T: %v", err, err) ++\t} ++} +-- +2.45.4 + diff --git a/SPECS/kata-containers-cc/CVE-2026-55969.patch b/SPECS/kata-containers-cc/CVE-2026-55969.patch new file mode 100644 index 00000000000..5efea928050 --- /dev/null +++ b/SPECS/kata-containers-cc/CVE-2026-55969.patch @@ -0,0 +1,163 @@ +From 37650feef9aa3d6d6d6bc6067b2212e774be6a85 Mon Sep 17 00:00:00 2001 +From: AllSpark +Date: Mon, 3 Aug 2026 18:24:20 +0000 +Subject: [PATCH] widen container size precheck to 64-bit in go protocols + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: AI Backport of https://github.com/apache/thrift/commit/ed643a86d4fec8d94dbff9048ad5fda67fcca473.patch +--- + .../thrift/lib/go/thrift/binary_protocol.go | 15 ++++++++++++ + .../thrift/lib/go/thrift/compact_protocol.go | 12 ++++++++++ + .../thrift/lib/go/thrift/configuration.go | 23 +++++++++++++++++++ + .../thrift/lib/go/thrift/json_protocol.go | 16 +++++++++++-- + 4 files changed, 64 insertions(+), 2 deletions(-) + +diff --git a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/binary_protocol.go b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/binary_protocol.go +index 45c880d..174dfca 100644 +--- a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/binary_protocol.go ++++ b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/binary_protocol.go +@@ -358,6 +358,11 @@ func (p *TBinaryProtocol) ReadMapBegin(ctx context.Context) (kType, vType TType, + err = invalidDataLength + return + } ++ minElemSize := p.getMinSerializedSize(kType) + p.getMinSerializedSize(vType) ++ err = checkContainerSizeForProtocol(int64(size32), minElemSize, p.cfg) ++ if err != nil { ++ return ++ } + size = int(size32) + return kType, vType, size, nil + } +@@ -382,6 +387,11 @@ func (p *TBinaryProtocol) ReadListBegin(ctx context.Context) (elemType TType, si + err = invalidDataLength + return + } ++ minElemSize := p.getMinSerializedSize(elemType) ++ err = checkContainerSizeForProtocol(int64(size32), minElemSize, p.cfg) ++ if err != nil { ++ return ++ } + size = int(size32) + + return +@@ -407,6 +417,11 @@ func (p *TBinaryProtocol) ReadSetBegin(ctx context.Context) (elemType TType, siz + err = invalidDataLength + return + } ++ minElemSize := p.getMinSerializedSize(elemType) ++ err = checkContainerSizeForProtocol(int64(size32), minElemSize, p.cfg) ++ if err != nil { ++ return ++ } + size = int(size32) + return elemType, size, nil + } +diff --git a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/compact_protocol.go b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/compact_protocol.go +index 3e1988c..cfa23f2 100644 +--- a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/compact_protocol.go ++++ b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/compact_protocol.go +@@ -492,6 +492,12 @@ func (p *TCompactProtocol) ReadMapBegin(ctx context.Context) (keyType TType, val + } + keyType, _ = p.getTType(tCompactType(keyAndValueType >> 4)) + valueType, _ = p.getTType(tCompactType(keyAndValueType & 0xf)) ++ ++ minElemSize := p.getMinSerializedSize(keyType) + p.getMinSerializedSize(valueType) ++ err = checkContainerSizeForProtocol(int64(size32), minElemSize, p.cfg) ++ if err != nil { ++ return ++ } + return + } + +@@ -524,6 +530,12 @@ func (p *TCompactProtocol) ReadListBegin(ctx context.Context) (elemType TType, s + err = NewTProtocolException(e) + return + } ++ ++ minElemSize := p.getMinSerializedSize(elemType) ++ err = checkContainerSizeForProtocol(int64(size), minElemSize, p.cfg) ++ if err != nil { ++ return ++ } + return + } + +diff --git a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/configuration.go b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/configuration.go +index 454d9f3..376dae9 100644 +--- a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/configuration.go ++++ b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/configuration.go +@@ -22,6 +22,7 @@ package thrift + import ( + "crypto/tls" + "fmt" ++ "math" + "time" + ) + +@@ -318,6 +319,28 @@ func checkSizeForProtocol(size int32, cfg *TConfiguration) error { + return nil + } + ++// checkContainerSizeForProtocol validates the minimum on-wire size of a ++// container with the given wire-supplied element count, where each element ++// occupies at least minElemSize bytes. The count is range-checked and the ++// product is computed in 64-bit arithmetic, so the value handed to ++// checkSizeForProtocol always stays within int32 range. ++func checkContainerSizeForProtocol(size int64, minElemSize int32, cfg *TConfiguration) error { ++ if size < 0 { ++ return NewTProtocolExceptionWithType( ++ NEGATIVE_SIZE, ++ fmt.Errorf("negative size: %d", size), ++ ) ++ } ++ totalMinSize := size * int64(minElemSize) ++ if totalMinSize > math.MaxInt32 { ++ return NewTProtocolExceptionWithType( ++ SIZE_LIMIT, ++ fmt.Errorf("size exceeded max allowed: %d", totalMinSize), ++ ) ++ } ++ return checkSizeForProtocol(int32(totalMinSize), cfg) ++} ++ + type tTransportFactoryConf struct { + delegate TTransportFactory + cfg *TConfiguration +diff --git a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/json_protocol.go b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/json_protocol.go +index 8e59d16..0032c5b 100644 +--- a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/json_protocol.go ++++ b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/json_protocol.go +@@ -317,6 +317,12 @@ func (p *TJSONProtocol) ReadMapBegin(ctx context.Context) (keyType TType, valueT + } + size = int(iSize) + ++ minElemSize := p.getMinSerializedSize(keyType) + p.getMinSerializedSize(valueType) ++ e = checkContainerSizeForProtocol(iSize, minElemSize, p.cfg) ++ if e != nil { ++ return keyType, valueType, 0, e ++ } ++ + _, e = p.ParseObjectStart() + return keyType, valueType, size, e + } +@@ -485,9 +491,15 @@ func (p *TJSONProtocol) ParseElemListBegin() (elemType TType, size int, e error) + if err != nil { + return elemType, size, err + } +- nSize, _, err2 := p.ParseI64() ++ nSize, _, err := p.ParseI64() + size = int(nSize) +- return elemType, size, err2 ++ ++ minElemSize := p.getMinSerializedSize(elemType) ++ err = checkContainerSizeForProtocol(nSize, minElemSize, p.cfg) ++ if err != nil { ++ return elemType, 0, err ++ } ++ return elemType, size, nil + } + + func (p *TJSONProtocol) readElemListBegin() (elemType TType, size int, e error) { +-- +2.45.4 + diff --git a/SPECS/kata-containers-cc/kata-containers-cc.spec b/SPECS/kata-containers-cc/kata-containers-cc.spec index 4179deb48af..15168bb7232 100644 --- a/SPECS/kata-containers-cc/kata-containers-cc.spec +++ b/SPECS/kata-containers-cc/kata-containers-cc.spec @@ -3,7 +3,7 @@ Name: kata-containers-cc Version: 3.15.0.aks0 -Release: 16%{?dist} +Release: 17%{?dist} Summary: Kata Confidential Containers package developed for Confidential Containers on AKS License: ASL 2.0 URL: https://github.com/microsoft/kata-containers @@ -19,6 +19,9 @@ Patch4: CVE-2025-5791.patch Patch5: CVE-2025-4574.patch Patch6: CVE-2026-42250.patch Patch7: CVE-2026-56852.patch +Patch8: CVE-2026-43871.patch +Patch9: CVE-2026-48586.patch +Patch10: CVE-2026-55969.patch ExclusiveArch: x86_64 BuildRequires: azurelinux-release @@ -154,6 +157,9 @@ fi %{tools_pkg}/tools/osbuilder/node-builder/azure-linux/agent-install/usr/lib/systemd/system/kata-agent.service %changelog +* Mon Aug 03 2026 Azure Linux Security Servicing Account - 3.15.0.aks0-17 +- Patch for CVE-2026-55969, CVE-2026-48586, CVE-2026-43871 + * Mon Jul 27 2026 Azure Linux Security Servicing Account - 3.15.0.aks0-16 - Patch for CVE-2026-56852 From 3fc6c9d5b4710f4989e97a1d406f4aba568bd75b Mon Sep 17 00:00:00 2001 From: Swapnil Sahu Date: Wed, 5 Aug 2026 09:02:30 +0000 Subject: [PATCH 2/3] Updated patch file to fix build issues --- SPECS/kata-containers-cc/CVE-2026-48586.patch | 78 +----- SPECS/kata-containers-cc/CVE-2026-55969.patch | 229 +++++++++++++++--- 2 files changed, 199 insertions(+), 108 deletions(-) diff --git a/SPECS/kata-containers-cc/CVE-2026-48586.patch b/SPECS/kata-containers-cc/CVE-2026-48586.patch index 17267c8150d..776db21de5e 100644 --- a/SPECS/kata-containers-cc/CVE-2026-48586.patch +++ b/SPECS/kata-containers-cc/CVE-2026-48586.patch @@ -6,13 +6,11 @@ Subject: [PATCH] Add decompressed data size limit to TZlibTransport Client: go Signed-off-by: Azure Linux Security Servicing Account Upstream-reference: AI Backport of https://github.com/apache/thrift/commit/aed9eb012c76d3d59618cbdc225c65f013ce3ab0.patch --- - .../thrift/lib/go/thrift/zlib_transport.go | 23 +++++-- - .../lib/go/thrift/zlib_transport_test.go | 64 +++++++++++++++++++ - 2 files changed, 83 insertions(+), 4 deletions(-) - create mode 100644 src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/zlib_transport_test.go + .../thrift/lib/go/thrift/zlib_transport.go | 23 +++++++++++++++---- + 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/zlib_transport.go b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/zlib_transport.go -index 259943a..328c704 100644 +index 259943a6..328c7049 100644 --- a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/zlib_transport.go +++ b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/zlib_transport.go @@ -22,6 +22,7 @@ package thrift @@ -73,76 +71,6 @@ index 259943a..328c704 100644 PropagateTConfiguration(z.transport, conf) } -diff --git a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/zlib_transport_test.go b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/zlib_transport_test.go -new file mode 100644 -index 0000000..191b6b9 ---- /dev/null -+++ b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/zlib_transport_test.go -@@ -0,0 +1,64 @@ -+/* -+ * Licensed to the Apache Software Foundation (ASF) under one -+ * or more contributor license agreements. See the NOTICE file -+ * distributed with this work for additional information -+ * regarding copyright ownership. The ASF licenses this file -+ * to you under the Apache License, Version 2.0 (the -+ * "License"); you may not use this file except in compliance -+ * with the License. You may obtain a copy of the License at -+ * -+ * http://www.apache.org/licenses/LICENSE-2.0 -+ * -+ * Unless required by applicable law or agreed to in writing, -+ * software distributed under the License is distributed on an -+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -+ * KIND, either express or implied. See the License for the -+ * specific language governing permissions and limitations -+ * under the License. -+ */ -+ -+package thrift -+ -+import ( -+\t"bytes" -+\t"compress/zlib" -+\t"context" -+\t"testing" -+) -+ -+func TestZlibTransportMessageSizeLimit(t *testing.T) { -+\tconst dataSize = 4096 -+\tdata := bytes.Repeat([]byte{'a'}, dataSize) -+ -+\t// Write and flush (not close) so TMemoryBuffer.Close() doesn't wipe the data. -+\twriteBuf := NewTMemoryBuffer() -+\twriter, err := NewTZlibTransport(writeBuf, zlib.BestCompression) -+\tif err != nil { -+\t\tt.Fatal(err) -+\t} -+\tif _, err := writer.Write(data); err != nil { -+\t\tt.Fatal(err) -+\t} -+\tif err := writer.Flush(context.Background()); err != nil { -+\t\tt.Fatal(err) -+\t} -+\tcompressed := make([]byte, writeBuf.Len()) -+\tcopy(compressed, writeBuf.Bytes()) -+ -+\treadBuf := NewTMemoryBuffer() -+\treadBuf.Write(compressed) -+\treader, err := NewTZlibTransport(readBuf, zlib.BestCompression) -+\tif err != nil { -+\t\tt.Fatal(err) -+\t} -+\treader.SetTConfiguration(&TConfiguration{MaxMessageSize: 1024}) -+ -+\t_, err = reader.Read(make([]byte, dataSize)) -+\tif err == nil { -+\t\tt.Fatal("expected SIZE_LIMIT error, got nil") -+\t} -+\tprotoEx, ok := err.(TProtocolException) -+\tif !ok || protoEx.TypeId() != SIZE_LIMIT { -+\t\tt.Fatalf("expected SIZE_LIMIT TProtocolException, got %T: %v", err, err) -+\t} -+} -- 2.45.4 diff --git a/SPECS/kata-containers-cc/CVE-2026-55969.patch b/SPECS/kata-containers-cc/CVE-2026-55969.patch index 5efea928050..6ae89193302 100644 --- a/SPECS/kata-containers-cc/CVE-2026-55969.patch +++ b/SPECS/kata-containers-cc/CVE-2026-55969.patch @@ -6,54 +6,100 @@ Subject: [PATCH] widen container size precheck to 64-bit in go protocols Signed-off-by: Azure Linux Security Servicing Account Upstream-reference: AI Backport of https://github.com/apache/thrift/commit/ed643a86d4fec8d94dbff9048ad5fda67fcca473.patch --- - .../thrift/lib/go/thrift/binary_protocol.go | 15 ++++++++++++ - .../thrift/lib/go/thrift/compact_protocol.go | 12 ++++++++++ - .../thrift/lib/go/thrift/configuration.go | 23 +++++++++++++++++++ - .../thrift/lib/go/thrift/json_protocol.go | 16 +++++++++++-- - 4 files changed, 64 insertions(+), 2 deletions(-) + .../thrift/lib/go/thrift/binary_protocol.go | 53 ++++++++++++++-- + .../thrift/lib/go/thrift/compact_protocol.go | 50 ++++++++++++++++ + .../thrift/lib/go/thrift/configuration.go | 23 +++++++ + .../thrift/lib/go/thrift/json_protocol.go | 60 +++++++++++++++++-- + .../lib/go/thrift/simple_json_protocol.go | 2 + + 5 files changed, 177 insertions(+), 11 deletions(-) diff --git a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/binary_protocol.go b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/binary_protocol.go -index 45c880d..174dfca 100644 +index 45c880d3..2137cec1 100644 --- a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/binary_protocol.go +++ b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/binary_protocol.go -@@ -358,6 +358,11 @@ func (p *TBinaryProtocol) ReadMapBegin(ctx context.Context) (kType, vType TType, - err = invalidDataLength +@@ -354,8 +354,9 @@ func (p *TBinaryProtocol) ReadMapBegin(ctx context.Context) (kType, vType TType, + err = NewTProtocolException(e) return } +- if size32 < 0 { +- err = invalidDataLength + minElemSize := p.getMinSerializedSize(kType) + p.getMinSerializedSize(vType) + err = checkContainerSizeForProtocol(int64(size32), minElemSize, p.cfg) + if err != nil { -+ return -+ } + return + } size = int(size32) - return kType, vType, size, nil - } -@@ -382,6 +387,11 @@ func (p *TBinaryProtocol) ReadListBegin(ctx context.Context) (elemType TType, si - err = invalidDataLength +@@ -378,8 +379,9 @@ func (p *TBinaryProtocol) ReadListBegin(ctx context.Context) (elemType TType, si + err = NewTProtocolException(e) return } +- if size32 < 0 { +- err = invalidDataLength + minElemSize := p.getMinSerializedSize(elemType) + err = checkContainerSizeForProtocol(int64(size32), minElemSize, p.cfg) + if err != nil { -+ return -+ } + return + } size = int(size32) - - return -@@ -407,6 +417,11 @@ func (p *TBinaryProtocol) ReadSetBegin(ctx context.Context) (elemType TType, siz - err = invalidDataLength +@@ -403,8 +405,9 @@ func (p *TBinaryProtocol) ReadSetBegin(ctx context.Context) (elemType TType, siz + err = NewTProtocolException(e) return } +- if size32 < 0 { +- err = invalidDataLength + minElemSize := p.getMinSerializedSize(elemType) + err = checkContainerSizeForProtocol(int64(size32), minElemSize, p.cfg) + if err != nil { -+ return -+ } + return + } size = int(size32) - return elemType, size, nil - } +@@ -540,6 +543,44 @@ var ( + _ TConfigurationSetter = (*TBinaryProtocol)(nil) + ) + ++// Return the minimum number of bytes a type will consume on the wire ++func (p *TBinaryProtocol) getMinSerializedSize(ttype TType) int32 { ++ switch ttype { ++ case STOP: ++ return 1 // T_STOP needs to count itself ++ case VOID: ++ return 1 // T_VOID needs to count itself ++ case BOOL: ++ return 1 // sizeof(int8) ++ case BYTE: ++ return 1 // sizeof(int8) ++ case DOUBLE: ++ return 8 // sizeof(double) ++ case I16: ++ return 2 // sizeof(short) ++ case I32: ++ return 4 // sizeof(int) ++ case I64: ++ return 8 // sizeof(long) ++ case STRING: ++ return 4 // string length ++ case STRUCT: ++ return 1 // empty struct needs at least 1 byte for the T_STOP ++ case MAP: ++ return 4 // element count ++ case SET: ++ return 4 // element count ++ case LIST: ++ return 4 // element count ++ case UTF8: ++ return 4 // fixed-width 4-byte string length prefix ++ case UTF16: ++ return 4 // fixed-width 4-byte string length prefix ++ default: ++ return 1 // unknown type ++ } ++} ++ + // This function is shared between TBinaryProtocol and TCompactProtocol. + // + // It tries to read size bytes from trans, in a way that prevents large diff --git a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/compact_protocol.go b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/compact_protocol.go -index 3e1988c..cfa23f2 100644 +index 32c269dd..5a69d3ec 100644 --- a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/compact_protocol.go +++ b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/compact_protocol.go @@ -492,6 +492,12 @@ func (p *TCompactProtocol) ReadMapBegin(ctx context.Context) (keyType TType, val @@ -82,8 +128,53 @@ index 3e1988c..cfa23f2 100644 return } +@@ -863,6 +875,44 @@ func (p *TCompactProtocol) SetTConfiguration(conf *TConfiguration) { + p.cfg = conf + } + ++// Return the minimum number of bytes a type will consume on the wire ++func (p *TCompactProtocol) getMinSerializedSize(ttype TType) int32 { ++ switch ttype { ++ case STOP: ++ return 1 // T_STOP needs to count itself ++ case VOID: ++ return 1 // T_VOID needs to count itself ++ case BOOL: ++ return 1 // sizeof(int8) ++ case BYTE: ++ return 1 // sizeof(int8) ++ case DOUBLE: ++ return 8 // uses PutUint64() which always writes 8 bytes ++ case I16: ++ return 1 // zigzag ++ case I32: ++ return 1 // zigzag ++ case I64: ++ return 1 // zigzag ++ case STRING: ++ return 1 // string length ++ case STRUCT: ++ return 1 // empty struct needs at least 1 byte for the T_STOP ++ case MAP: ++ return 1 // element count ++ case SET: ++ return 1 // element count ++ case LIST: ++ return 1 // element count ++ case UTF8: ++ return 1 // minimum one-byte varint string length ++ case UTF16: ++ return 1 // minimum one-byte varint string length ++ default: ++ return 1 // unknown type ++ } ++} ++ + var ( + _ TConfigurationSetter = (*TCompactProtocolFactory)(nil) + _ TConfigurationSetter = (*TCompactProtocol)(nil) diff --git a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/configuration.go b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/configuration.go -index 454d9f3..376dae9 100644 +index 454d9f37..376dae9f 100644 --- a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/configuration.go +++ b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/configuration.go @@ -22,6 +22,7 @@ package thrift @@ -124,23 +215,32 @@ index 454d9f3..376dae9 100644 delegate TTransportFactory cfg *TConfiguration diff --git a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/json_protocol.go b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/json_protocol.go -index 8e59d16..0032c5b 100644 +index 8e59d16c..f40af655 100644 --- a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/json_protocol.go +++ b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/json_protocol.go -@@ -317,6 +317,12 @@ func (p *TJSONProtocol) ReadMapBegin(ctx context.Context) (keyType TType, valueT +@@ -311,12 +311,18 @@ func (p *TJSONProtocol) ReadMapBegin(ctx context.Context) (keyType TType, valueT + } + + // read size +- iSize, e := p.ReadI64(ctx) +- if e != nil { +- return keyType, valueType, size, e ++ iSize, err := p.ReadI64(ctx) ++ if err != nil { ++ return keyType, valueType, size, err } size = int(iSize) + minElemSize := p.getMinSerializedSize(keyType) + p.getMinSerializedSize(valueType) -+ e = checkContainerSizeForProtocol(iSize, minElemSize, p.cfg) -+ if e != nil { -+ return keyType, valueType, 0, e ++ err = checkContainerSizeForProtocol(iSize, minElemSize, p.cfg) ++ if err != nil { ++ return keyType, valueType, 0, err + } + _, e = p.ParseObjectStart() return keyType, valueType, size, e } -@@ -485,9 +491,15 @@ func (p *TJSONProtocol) ParseElemListBegin() (elemType TType, size int, e error) +@@ -506,9 +512,15 @@ func (p *TJSONProtocol) readElemListBegin() (elemType TType, size int, e error) if err != nil { return elemType, size, err } @@ -157,7 +257,70 @@ index 8e59d16..0032c5b 100644 + return elemType, size, nil } - func (p *TJSONProtocol) readElemListBegin() (elemType TType, size int, e error) { + func (p *TJSONProtocol) writeElemListBegin(elemType TType, size int) error { +@@ -588,4 +600,42 @@ func (p *TJSONProtocol) StringToTypeId(fieldType string) (TType, error) { + return TType(STOP), NewTProtocolExceptionWithType(INVALID_DATA, e) + } + ++// Return the minimum number of bytes a type will consume on the wire ++func (p *TJSONProtocol) getMinSerializedSize(ttype TType) int32 { ++ switch ttype { ++ case STOP: ++ return 1 // T_STOP needs to count itself ++ case VOID: ++ return 1 // T_VOID needs to count itself ++ case BOOL: ++ return 1 // written as int ++ case BYTE: ++ return 1 ++ case DOUBLE: ++ return 1 ++ case I16: ++ return 1 ++ case I32: ++ return 1 ++ case I64: ++ return 1 ++ case STRING: ++ return 2 // empty string ++ case STRUCT: ++ return 2 // empty struct ++ case MAP: ++ return 2 // empty map ++ case SET: ++ return 2 // empty set ++ case LIST: ++ return 2 // empty list ++ case UTF8: ++ return 2 // empty utf8 ++ case UTF16: ++ return 2 // empty utf16 ++ default: ++ return 1 // unknown type ++ } ++} ++ + var _ TConfigurationSetter = (*TJSONProtocol)(nil) +diff --git a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/simple_json_protocol.go b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/simple_json_protocol.go +index d1a81545..f42aac04 100644 +--- a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/simple_json_protocol.go ++++ b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/simple_json_protocol.go +@@ -97,6 +97,7 @@ var errEmptyJSONContextStack = NewTProtocolExceptionWithType(INVALID_DATA, error + type TSimpleJSONProtocol struct { + trans TTransport + ++ cfg *TConfiguration + parseContextStack jsonContextStack + dumpContext jsonContextStack + +@@ -1367,6 +1368,7 @@ func (p *TSimpleJSONProtocol) write(b []byte) (int, error) { + + // SetTConfiguration implements TConfigurationSetter for propagation. + func (p *TSimpleJSONProtocol) SetTConfiguration(conf *TConfiguration) { ++ p.cfg = conf + PropagateTConfiguration(p.trans, conf) + } + -- 2.45.4 From 2bad79dd1220900caf9cf4fd66e7191c8dc85c3c Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Wed, 12 Aug 2026 19:25:59 +0000 Subject: [PATCH 3/3] Patch kata-containers-cc for CVE-2026-50540 --- SPECS/kata-containers-cc/CVE-2026-50540.patch | 226 ++++++++++++++++++ .../kata-containers-cc.spec | 3 +- 2 files changed, 228 insertions(+), 1 deletion(-) create mode 100644 SPECS/kata-containers-cc/CVE-2026-50540.patch diff --git a/SPECS/kata-containers-cc/CVE-2026-50540.patch b/SPECS/kata-containers-cc/CVE-2026-50540.patch new file mode 100644 index 00000000000..b59bd3ab12b --- /dev/null +++ b/SPECS/kata-containers-cc/CVE-2026-50540.patch @@ -0,0 +1,226 @@ +From dccb4ca8ce5f17da06f8ceaf826ed00213bfb7b4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= +Date: Fri, 29 May 2026 09:13:19 +0200 +Subject: [PATCH] runtimes: remove config_path sandbox annotation override +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Stop accepting io.katacontainers.config_path so config selection comes +only from shim options, KATA_CONF_FILE, and defaults. + +Signed-off-by: Fabiano Fidêncio +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/kata-containers/kata-containers/commit/03cc670076099530f4e1e9cb22849afdafb20f65.patch +--- + docs/how-to/how-to-set-sandbox-config-kata.md | 1 - + src/libs/kata-types/src/annotations/mod.rs | 6 ------ + src/runtime-rs/crates/runtimes/src/manager.rs | 11 ++++------- + src/runtime/README.md | 3 --- + src/runtime/pkg/containerd-shim-v2/create.go | 13 ++++++------- + .../pkg/containerd-shim-v2/create_test.go | 19 +++++-------------- + src/runtime/pkg/oci/utils.go | 4 ---- + .../pkg/annotations/annotations.go | 2 -- + 8 files changed, 15 insertions(+), 44 deletions(-) + +diff --git a/docs/how-to/how-to-set-sandbox-config-kata.md b/docs/how-to/how-to-set-sandbox-config-kata.md +index 776a7e02..8decbd46 100644 +--- a/docs/how-to/how-to-set-sandbox-config-kata.md ++++ b/docs/how-to/how-to-set-sandbox-config-kata.md +@@ -14,7 +14,6 @@ There are several kinds of Kata configurations and they are listed below. + ## Global Options + | Key | Value Type | Comments | + |-------| ----- | ----- | +-| `io.katacontainers.config_path` | string | Kata config file location that overrides the default config paths | + | `io.katacontainers.pkg.oci.bundle_path` | string | OCI bundle path | + | `io.katacontainers.pkg.oci.container_type`| string | OCI container type. Only accepts `pod_container` and `pod_sandbox` | + +diff --git a/src/libs/kata-types/src/annotations/mod.rs b/src/libs/kata-types/src/annotations/mod.rs +index 188d20a0..0786c8d7 100644 +--- a/src/libs/kata-types/src/annotations/mod.rs ++++ b/src/libs/kata-types/src/annotations/mod.rs +@@ -39,7 +39,6 @@ pub const KATA_ANNO_CFG_PREFIX: &str = "io.katacontainers.config."; + /// Prefix for Kata container annotations + pub const KATA_ANNO_CONTAINER_PREFIX: &str = "io.katacontainers.container."; + /// The annotation key to fetch runtime configuration file. +-pub const SANDBOX_CFG_PATH_KEY: &str = "io.katacontainers.config_path"; + + // OCI section + /// The annotation key to fetch the OCI configuration file path. +@@ -372,11 +371,6 @@ impl Annotation { + + // Miscellaneous annotations. + impl Annotation { +- /// Get the annotation of sandbox configuration file path. +- pub fn get_sandbox_config_path(&self) -> Option { +- self.get(SANDBOX_CFG_PATH_KEY) +- } +- + /// Get the annotation of bundle path. + pub fn get_bundle_path(&self) -> Option { + self.get(BUNDLE_PATH_KEY) +diff --git a/src/runtime-rs/crates/runtimes/src/manager.rs b/src/runtime-rs/crates/runtimes/src/manager.rs +index f092f2c9..e0bc5562 100644 +--- a/src/runtime-rs/crates/runtimes/src/manager.rs ++++ b/src/runtime-rs/crates/runtimes/src/manager.rs +@@ -617,19 +617,16 @@ impl RuntimeHandlerManager { + } + + /// Config override ordering(high to low): +-/// 1. podsandbox annotation +-/// 2. environment variable +-/// 3. shimv2 create task option +-/// 4. If above three are not set, then get default path from DEFAULT_RUNTIME_CONFIGURATIONS ++/// 1. environment variable ++/// 2. shimv2 create task option ++/// 3. If above two are not set, then get default path from DEFAULT_RUNTIME_CONFIGURATIONS + /// in kata-containers/src/libs/kata-types/src/config/default.rs, in array order. + #[instrument] + fn load_config(an: &HashMap, option: &Option>) -> Result { + const KATA_CONF_FILE: &str = "KATA_CONF_FILE"; + let annotation = Annotation::new(an.clone()); + +- let config_path = if let Some(path) = annotation.get_sandbox_config_path() { +- path +- } else if let Ok(path) = std::env::var(KATA_CONF_FILE) { ++ let config_path = if let Ok(path) = std::env::var(KATA_CONF_FILE) { + path + } else if let Some(option) = option { + // get rid of the special characters in options to get the config path +diff --git a/src/runtime/README.md b/src/runtime/README.md +index d2290e20..2e36133e 100644 +--- a/src/runtime/README.md ++++ b/src/runtime/README.md +@@ -61,9 +61,6 @@ Each option has a comment explaining its use. + + The shimv2 runtime looks for its configuration in the following places (in order): + +-- The `io.data containers.config.config_path` annotation specified +- in the OCI configuration file (`config.json` file) used to create the pod sandbox. +- + - The containerd + [shimv2](/docs/design/architecture/README.md#shim-v2-architecture) + options passed to the runtime. +diff --git a/src/runtime/pkg/containerd-shim-v2/create.go b/src/runtime/pkg/containerd-shim-v2/create.go +index 409532e1..7eaabdfe 100644 +--- a/src/runtime/pkg/containerd-shim-v2/create.go ++++ b/src/runtime/pkg/containerd-shim-v2/create.go +@@ -119,7 +119,7 @@ func create(ctx context.Context, s *service, r *taskAPI.CreateTaskRequest) (*con + disableOutput := noNeedForOutput(detach, ociSpec.Process.Terminal) + rootfs := filepath.Join(r.Bundle, "rootfs") + +- runtimeConfig, err := loadRuntimeConfig(s, r, ociSpec.Annotations) ++ runtimeConfig, err := loadRuntimeConfig(s, r) + if err != nil { + return nil, err + } +@@ -273,15 +273,14 @@ func loadSpec(r *taskAPI.CreateTaskRequest) (*specs.Spec, string, error) { + } + + // Config override ordering(high to low): +-// 1. podsandbox annotation +-// 2. shimv2 create task option +-// 3. environment +-func loadRuntimeConfig(s *service, r *taskAPI.CreateTaskRequest, anno map[string]string) (*oci.RuntimeConfig, error) { ++// 1. shimv2 create task option ++// 2. environment ++func loadRuntimeConfig(s *service, r *taskAPI.CreateTaskRequest) (*oci.RuntimeConfig, error) { + if s.config != nil { + return s.config, nil + } +- configPath := oci.GetSandboxConfigPath(anno) +- if configPath == "" && r.Options != nil { ++ configPath := "" ++ if r.Options != nil { + v, err := typeurl.UnmarshalAny(r.Options) + if err != nil { + return nil, err +diff --git a/src/runtime/pkg/containerd-shim-v2/create_test.go b/src/runtime/pkg/containerd-shim-v2/create_test.go +index 67530caf..5da89c9a 100644 +--- a/src/runtime/pkg/containerd-shim-v2/create_test.go ++++ b/src/runtime/pkg/containerd-shim-v2/create_test.go +@@ -23,7 +23,6 @@ import ( + "github.com/kata-containers/kata-containers/src/runtime/pkg/device/config" + ktu "github.com/kata-containers/kata-containers/src/runtime/pkg/katatestutils" + vc "github.com/kata-containers/kata-containers/src/runtime/virtcontainers" +- vcAnnotations "github.com/kata-containers/kata-containers/src/runtime/virtcontainers/pkg/annotations" + "github.com/kata-containers/kata-containers/src/runtime/virtcontainers/pkg/compatoci" + "github.com/kata-containers/kata-containers/src/runtime/virtcontainers/pkg/vcmock" + ) +@@ -393,11 +392,9 @@ func TestCreateLoadRuntimeConfig(t *testing.T) { + ctx: context.Background(), + } + r := &taskAPI.CreateTaskRequest{} +- anno := make(map[string]string) + + // set all to fake path + fakeConfig := "foobar" +- anno[vcAnnotations.SandboxConfigPathKey] = fakeConfig + option := &crioption.Options{ConfigPath: fakeConfig} + r.Options, err = protobuf.MarshalAnyToProto(option) + assert.NoError(err) +@@ -406,28 +403,22 @@ func TestCreateLoadRuntimeConfig(t *testing.T) { + defer os.Setenv("KATA_CONF_FILE", "") + + // fake config should fail +- _, err = loadRuntimeConfig(s, r, anno) ++ _, err = loadRuntimeConfig(s, r) + assert.Error(err) + +- // 1. podsandbox annotation +- anno[vcAnnotations.SandboxConfigPathKey] = config +- _, err = loadRuntimeConfig(s, r, anno) +- assert.NoError(err) +- anno[vcAnnotations.SandboxConfigPathKey] = "" +- +- // 2. shimv2 create task option ++ // 1. shimv2 create task option + option.ConfigPath = config + r.Options, err = protobuf.MarshalAnyToProto(option) + assert.NoError(err) +- _, err = loadRuntimeConfig(s, r, anno) ++ _, err = loadRuntimeConfig(s, r) + assert.NoError(err) + option.ConfigPath = "" + r.Options, err = protobuf.MarshalAnyToProto(option) + assert.NoError(err) + +- // 3. environment ++ // 2. environment + err = os.Setenv("KATA_CONF_FILE", config) + assert.NoError(err) +- _, err = loadRuntimeConfig(s, r, anno) ++ _, err = loadRuntimeConfig(s, r) + assert.NoError(err) + } +diff --git a/src/runtime/pkg/oci/utils.go b/src/runtime/pkg/oci/utils.go +index c763457a..3b908b03 100644 +--- a/src/runtime/pkg/oci/utils.go ++++ b/src/runtime/pkg/oci/utils.go +@@ -395,10 +395,6 @@ func ContainerType(spec specs.Spec) (vc.ContainerType, error) { + return vc.SingleContainer, nil + } + +-func GetSandboxConfigPath(annotations map[string]string) string { +- return annotations[vcAnnotations.SandboxConfigPathKey] +-} +- + // SandboxID determines the sandbox ID related to an OCI configuration. This function + // is expected to be called only when the container type is "PodContainer". + func SandboxID(spec specs.Spec) (string, error) { +diff --git a/src/runtime/virtcontainers/pkg/annotations/annotations.go b/src/runtime/virtcontainers/pkg/annotations/annotations.go +index 22eee2ae..d63ff3e3 100644 +--- a/src/runtime/virtcontainers/pkg/annotations/annotations.go ++++ b/src/runtime/virtcontainers/pkg/annotations/annotations.go +@@ -20,8 +20,6 @@ const ( + + // ContainerTypeKey is the annotation key to fetch container type. + ContainerTypeKey = kataAnnotationsPrefix + "pkg.oci.container_type" +- +- SandboxConfigPathKey = kataAnnotationsPrefix + "config_path" + ) + + // Annotations related to Hypervisor configuration +-- +2.45.4 + diff --git a/SPECS/kata-containers-cc/kata-containers-cc.spec b/SPECS/kata-containers-cc/kata-containers-cc.spec index 15168bb7232..b8fcb4030b9 100644 --- a/SPECS/kata-containers-cc/kata-containers-cc.spec +++ b/SPECS/kata-containers-cc/kata-containers-cc.spec @@ -22,6 +22,7 @@ Patch7: CVE-2026-56852.patch Patch8: CVE-2026-43871.patch Patch9: CVE-2026-48586.patch Patch10: CVE-2026-55969.patch +Patch11: CVE-2026-50540.patch ExclusiveArch: x86_64 BuildRequires: azurelinux-release @@ -158,7 +159,7 @@ fi %changelog * Mon Aug 03 2026 Azure Linux Security Servicing Account - 3.15.0.aks0-17 -- Patch for CVE-2026-55969, CVE-2026-48586, CVE-2026-43871 +- Patch for CVE-2026-55969, CVE-2026-48586, CVE-2026-43871, CVE-2026-50540 * Mon Jul 27 2026 Azure Linux Security Servicing Account - 3.15.0.aks0-16 - Patch for CVE-2026-56852