Weekly portage-stable package updates 2026-08-03

.github/workflows/portage-stable-packages-list

@@ -117,7 +117,9 @@ app-cdr/cdrtools
 app-containers/aardvark-dns
 app-containers/catatonit
 app-containers/conmon
+app-containers/container-libs
 app-containers/containerd
+app-containers/containers-shortnames
 app-containers/cri-tools
 app-containers/crun
 app-containers/docker
@@ -239,6 +241,7 @@ dev-lang/swig
 dev-lang/tcl
 dev-lang/yasm
 
+dev-libs/blake3
 dev-libs/cJSON
 dev-libs/cowsql
 dev-libs/cyrus-sasl

changelog/security/2026-08-07-weekly-updates.md

@@ -0,0 +1,28 @@
+- bzip2 ([CVE-2026-42250](https://www.cve.org/CVERecord/?id=CVE-2026-42250))
+- c-ares ([CVE-2026-33630](https://www.cve.org/CVERecord/?id=CVE-2026-33630), [GHSA-pjmc-gx33-gc76](https://github.com/c-ares/c-ares/security/advisories/GHSA-pjmc-gx33-gc76), [GHSA-jv8r-gqr9-68wj](https://github.com/c-ares/c-ares/security/advisories/GHSA-jv8r-gqr9-68wj))
+- containerd ([CVE-2026-24051](https://www.cve.org/CVERecord/?id=CVE-2026-24051), [CVE-2026-33186](https://www.cve.org/CVERecord/?id=CVE-2026-33186), [CVE-2026-34986](https://www.cve.org/CVERecord/?id=CVE-2026-34986), [CVE-2026-35469](https://www.cve.org/CVERecord/?id=CVE-2026-35469), [CVE-2026-39883](https://www.cve.org/CVERecord/?id=CVE-2026-39883))
+- coreutils ([CVE-2026-56391](https://www.cve.org/CVERecord/?id=CVE-2026-56391), [CVE-2026-56392](https://www.cve.org/CVERecord/?id=CVE-2026-56392))
+- cri-tools ([CVE-2026-32285](https://www.cve.org/CVERecord/?id=CVE-2026-32285), [CVE-2026-24051](https://www.cve.org/CVERecord/?id=CVE-2026-24051), [CVE-2026-33186](https://www.cve.org/CVERecord/?id=CVE-2026-33186))
+- diffutils ([CVE-2026-53910](https://www.cve.org/CVERecord/?id=CVE-2026-53910))
+- docker ([CVE-2026-24051](https://www.cve.org/CVERecord/?id=CVE-2026-24051), [CVE-2026-33186](https://www.cve.org/CVERecord/?id=CVE-2026-33186), [CVE-2026-33997](https://www.cve.org/CVERecord/?id=CVE-2026-33997), [CVE-2026-34040](https://www.cve.org/CVERecord/?id=CVE-2026-34040), [CVE-2026-39883](https://www.cve.org/CVERecord/?id=CVE-2026-39883), [CVE-2026-41567](https://www.cve.org/CVERecord/?id=CVE-2026-41567), [CVE-2026-42306](https://www.cve.org/CVERecord/?id=CVE-2026-42306), [CVE-2026-33747](https://www.cve.org/CVERecord/?id=CVE-2026-33747), [CVE-2026-33748](https://www.cve.org/CVERecord/?id=CVE-2026-33748))
+- docker-buildx ([CVE-2025-0495](https://www.cve.org/CVERecord/?id=CVE-2025-0495))
+- etcd ([CVE-2025-22869](https://www.cve.org/CVERecord/?id=CVE-2025-22869), [CVE-2025-30204](https://www.cve.org/CVERecord/?id=CVE-2025-30204), [CVE-2026-33186](https://www.cve.org/CVERecord/?id=CVE-2026-33186))
+- go ([CVE-2026-27145](https://www.cve.org/CVERecord/?id=CVE-2026-27145), [CVE-2026-39822](https://www.cve.org/CVERecord/?id=CVE-2026-39822), [CVE-2026-42504](https://www.cve.org/CVERecord/?id=CVE-2026-42504), [CVE-2026-42505](https://www.cve.org/CVERecord/?id=CVE-2026-42505), [CVE-2026-42507](https://www.cve.org/CVERecord/?id=CVE-2026-42507))
+- gzip ([CVE-2026-41991](https://www.cve.org/CVERecord/?id=CVE-2026-41991))
+- jq ([CVE-2026-32316](https://www.cve.org/CVERecord/?id=CVE-2026-32316), [CVE-2026-33947](https://www.cve.org/CVERecord/?id=CVE-2026-33947), [CVE-2026-33948](https://www.cve.org/CVERecord/?id=CVE-2026-33948), [CVE-2026-39956](https://www.cve.org/CVERecord/?id=CVE-2026-39956), [CVE-2026-39979](https://www.cve.org/CVERecord/?id=CVE-2026-39979), [CVE-2026-40164](https://www.cve.org/CVERecord/?id=CVE-2026-40164), [CVE-2026-41256](https://www.cve.org/CVERecord/?id=CVE-2026-41256), [CVE-2026-41257](https://www.cve.org/CVERecord/?id=CVE-2026-41257), [CVE-2026-43894](https://www.cve.org/CVERecord/?id=CVE-2026-43894), [CVE-2026-43895](https://www.cve.org/CVERecord/?id=CVE-2026-43895), [CVE-2026-43896](https://www.cve.org/CVERecord/?id=CVE-2026-43896), [CVE-2026-44777](https://www.cve.org/CVERecord/?id=CVE-2026-44777), [CVE-2026-47770](https://www.cve.org/CVERecord/?id=CVE-2026-47770), [CVE-2026-49839](https://www.cve.org/CVERecord/?id=CVE-2026-49839), [CVE-2026-54679](https://www.cve.org/CVERecord/?id=CVE-2026-54679))
+- json-c ([CVE-2026-9146](https://www.cve.org/CVERecord/?id=CVE-2026-9146))
+- libxml2 ([CVE-2026-11979](https://www.cve.org/CVERecord/?id=CVE-2026-11979))
+- mit-krb5 ([CVE-2026-40355](https://www.cve.org/CVERecord/?id=CVE-2026-40355), [CVE-2026-40356](https://www.cve.org/CVERecord/?id=CVE-2026-40356))
+- opensc ([CVE-2025-13763](https://www.cve.org/CVERecord/?id=CVE-2025-13763), [CVE-2025-49010](https://www.cve.org/CVERecord/?id=CVE-2025-49010), [CVE-2025-66037](https://www.cve.org/CVERecord/?id=CVE-2025-66037), [CVE-2025-66038](https://www.cve.org/CVERecord/?id=CVE-2025-66038), [CVE-2025-66215](https://www.cve.org/CVERecord/?id=CVE-2025-66215))
+- p11-kit ([CVE-2026-13757](https://www.cve.org/CVERecord/?id=CVE-2026-13757))
+- pam ([CVE-2026-54411](https://www.cve.org/CVERecord/?id=CVE-2026-54411))
+- policycoreutils ([CVE-2026-59676](https://www.cve.org/CVERecord/?id=CVE-2026-59676), [CVE-2026-59677](https://www.cve.org/CVERecord/?id=CVE-2026-59677))
+- qemu ([CVE-2026-3886](https://www.cve.org/CVERecord/?id=CVE-2026-3886))
+- socat ([CVE-2026-56123](https://www.cve.org/CVERecord/?id=CVE-2026-56123))
+- sssd ([CVE-2026-12610](https://www.cve.org/CVERecord/?id=CVE-2026-12610), [CVE-2026-14474](https://www.cve.org/CVERecord/?id=CVE-2026-14474), [CVE-2026-14476](https://www.cve.org/CVERecord/?id=CVE-2026-14476))
+- util-linux ([CVE-2026-13595](https://www.cve.org/CVERecord/?id=CVE-2026-13595), [CVE-2026-53612](https://www.cve.org/CVERecord/?id=CVE-2026-53612), [CVE-2026-53613](https://www.cve.org/CVERecord/?id=CVE-2026-53613), [CVE-2026-53614](https://www.cve.org/CVERecord/?id=CVE-2026-53614))
+- wget ([CVE-2026-15146](https://www.cve.org/CVERecord/?id=CVE-2026-15146), [CVE-2026-58469](https://www.cve.org/CVERecord/?id=CVE-2026-58469), [CVE-2026-58470](https://www.cve.org/CVERecord/?id=CVE-2026-58470), [CVE-2026-58471](https://www.cve.org/CVERecord/?id=CVE-2026-58471), [CVE-2026-58472](https://www.cve.org/CVERecord/?id=CVE-2026-58472))
+- tpm2-tools (GHSA-v7w4-4gc9-qcgv, GHSA-gwfg-w3jr-xh66, GHSA-qp88-8f4j-wv7q)
+- tpm2-tss (GHSA-q759-vqg7-8rc5, GHSA-7638-f8gq-c475, GHSA-p3px-r4mm-jpw5, GHSA-x5j2-26fc-hhc3, GHSA-gf8g-2r5c-74c7, GHSA-mj78-pj5v-wvjx, GHSA-v2qp-xh5m-44mf, GHSA-2q5v-c7hv-fvpf, GHSA-pcpw-8625-jqcp, GHSA-6grq-c24j-xcjr)
+- less ([less-20260606](https://greenwoodsoftware.com/less/news.704.html))
+- libseccomp ([GHSA-2hqh-5c36-grrm](https://github.com/seccomp/libseccomp/security/advisories/GHSA-2hqh-5c36-grrm), [GHSA-46fr-jh49-xvhx](https://github.com/seccomp/libseccomp/security/advisories/GHSA-46fr-jh49-xvhx), [GHSA-4q85-33p6-j5g6](https://github.com/seccomp/libseccomp/security/advisories/GHSA-4q85-33p6-j5g6))

changelog/updates/2026-08-07-weekly-updates.md

@@ -0,0 +1,50 @@
+- SDK: cmake ([4.3.4](https://cmake.org/cmake/help/v4.3/release/4.3.html#id4))
+- SDK: go ([1.26.5](https://go.dev/doc/devel/release#go1.26.5) (includes [1.26.4](https://go.dev/doc/devel/release#go1.26.4)))
+- SDK: nasm ([3.02](https://www.nasm.us/docs/3.02/nasmac.html))
+- SDK: opensc ([0.27.1](https://github.com/OpenSC/OpenSC/releases/tag/0.27.1))
+- SDK: pkgcheck ([0.10.40](https://github.com/pkgcore/pkgcheck/releases/tag/v0.10.40))
+- SDK: qemu ([10.2.3](https://lists.gnu.org/archive/html/qemu-stable/2026-05/msg00654.html))
+- base, dev: acl ([2.4.0](https://cgit.git.savannah.nongnu.org/cgit/acl.git/plain/doc/CHANGES?h=v2.4.0))
+- base, dev: attr ([2.6.0](https://cgit.git.savannah.nongnu.org/cgit/attr.git/plain/doc/CHANGES?h=v2.6.0))
+- base, dev: c-ares ([1.34.8](https://github.com/c-ares/c-ares/releases/tag/v1.34.8) (includes [1.34.7](https://github.com/c-ares/c-ares/releases/tag/v1.34.7)))
+- base, dev: cri-tools ([1.36.0](https://github.com/kubernetes-sigs/cri-tools/releases/tag/v1.36.0) (includes [1.35.0](https://github.com/kubernetes-sigs/cri-tools/releases/tag/v1.35.0), [1.34.0](https://github.com/kubernetes-sigs/cri-tools/releases/tag/v1.34.0)))
+- base, dev: etcd ([3.6.11](https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.6.md#v3611-2026-05-01))
+- base, dev: jq ([1.8.2](https://github.com/jqlang/jq/releases/tag/jq-1.8.2))
+- base, dev: json-c ([0.19](https://raw.githubusercontent.com/json-c/json-c/refs/heads/json-c-0.19/ChangeLog))
+- base, dev: less ([704](https://greenwoodsoftware.com/less/news.704.html) (includes [702](https://greenwoodsoftware.com/less/news.702.html)))
+- base, dev: libarchive ([3.8.9](https://github.com/libarchive/libarchive/releases/tag/v3.8.9))
+- base, dev: libgpg-error ([1.61](https://dev.gnupg.org/T8239.html))
+- base, dev: libnvme ([1.16.2](https://github.com/linux-nvme/libnvme/releases/tag/v1.16.2))
+- base, dev: libseccomp ([2.6.1](https://github.com/seccomp/libseccomp/releases/tag/v2.6.1))
+- base, dev: libselinux ([3.11](https://github.com/SELinuxProject/selinux/releases/tag/3.11))
+- base, dev: libsemanage ([3.11](https://github.com/SELinuxProject/selinux/releases/tag/3.11) (includes [3.10](https://github.com/SELinuxProject/selinux/releases/tag/3.10), [3.9](https://github.com/SELinuxProject/selinux/releases/tag/3.9)))
+- base, dev: libsepol ([3.11](https://github.com/SELinuxProject/selinux/releases/tag/3.11))
+- base, dev: nghttp2 ([1.69.0](https://github.com/nghttp2/nghttp2/releases/tag/v1.69.0))
+- base, dev: ngtcp2 ([1.24.0](https://github.com/ngtcp2/ngtcp2/releases/tag/v1.2{4,3}.0) (includes [1.23.0](https://github.com/ngtcp2/ngtcp2/releases/tag/v1.23.0)))
+- base, dev: openssh ([10.4_p1](https://www.openssh.org/txt/release-10.4))
+- base, dev: p11-kit ([0.26.4](https://github.com/p11-glue/p11-kit/releases/tag/0.26.4) (includes [0.26.3](https://github.com/p11-glue/p11-kit/releases/tag/0.26.3)))
+- base, dev: policycoreutils ([3.11](https://github.com/SELinuxProject/selinux/releases/tag/3.11) (includes [3.10](https://github.com/SELinuxProject/selinux/releases/tag/3.10), [3.9](https://github.com/SELinuxProject/selinux/releases/tag/3.9)))
+- base, dev: samba ([4.24.4](https://www.samba.org/samba/history/samba-4.24.4.html) (includes [4.24.3](https://www.samba.org/samba/history/samba-4.24.3.html), [4.24.2](https://www.samba.org/samba/history/samba-4.24.2.html), [4.24.1](https://www.samba.org/samba/history/samba-4.24.1.html), [4.24.0](https://www.samba.org/samba/history/samba-4.24.0.html)))
+- base, dev: semodule-utils ([3.11](https://github.com/SELinuxProject/selinux/releases/tag/3.11))
+- base, dev: socat ([1.8.1.3](https://repo.or.cz/socat.git/blob/refs/tags/tag-1.8.1.3:/CHANGES))
+- base, dev: sssd ([2.13.1](https://sssd.io/release-notes/sssd-2.13.1.html))
+- base, dev: strace ([7.1](https://github.com/strace/strace/releases/tag/v7.1))
+- base, dev: tpm2-tools ([5.8](https://github.com/tpm2-software/tpm2-tools/releases/tag/5.8))
+- base, dev: tpm2-tss ([4.2.0](https://github.com/tpm2-software/tpm2-tss/releases/tag/4.2.0))
+- base, dev: util-linux ([2.42.2](https://github.com/util-linux/util-linux/blob/v2.42.2/Documentation/releases/v2.42.2-ReleaseNotes) (includes [2.42.1](https://github.com/util-linux/util-linux/blob/v2.42.1/Documentation/releases/v2.42.1-ReleaseNotes), [2.42](https://github.com/util-linux/util-linux/blob/v2.42/Documentation/releases/v2.42-ReleaseNotes)))
+- dev: file ([5.48](https://raw.githubusercontent.com/file/file/refs/tags/FILE5_48/ChangeLog))
+- dev: gentoolkit ([0.7.6](https://gitweb.gentoo.org/proj/gentoolkit.git/log/?h=gentoolkit-0.7.6))
+- dev: portage ([3.0.81.2](https://gitweb.gentoo.org/proj/portage.git/plain/NEWS?h=portage-3.0.81.2))
+- dev: sandbox ([2.49](https://gitweb.gentoo.org/proj/sandbox.git/log/?h=v2.49))
+- sysext-containerd: containerd ([2.3.3](https://github.com/containerd/containerd/releases/tag/v2.3.3) (includes [2.3.2](https://github.com/containerd/containerd/releases/tag/v2.3.2), [2.3.1](https://github.com/containerd/containerd/releases/tag/v2.3.1), [2.3.0](https://github.com/containerd/containerd/releases/tag/v2.3.0)))
+- sysext-docker: docker ([29.5.2](https://github.com/moby/moby/releases/tag/docker-v29.5.2) (includes [29.5.1](https://github.com/moby/moby/releases/tag/docker-v29.5.1), [29.5.0](https://github.com/moby/moby/releases/tag/docker-v29.5.0), [29.4.0](https://github.com/moby/moby/releases/tag/docker-v29.4.0), [29.3.0](https://github.com/moby/moby/releases/tag/docker-v29.3.0), [29.2.0](https://github.com/moby/moby/releases/tag/docker-v29.2.0)))
+- sysext-docker: docker-buildx ([0.35.0](https://github.com/docker/buildx/releases/tag/v0.36.0))
+- sysext-docker: docker-cli ([29.5.2](https://github.com/moby/moby/releases/tag/docker-v29.5.2) (includes [29.5.1](https://github.com/moby/moby/releases/tag/docker-v29.5.1), [29.5.0](https://github.com/moby/moby/releases/tag/docker-v29.5.0), [29.4.0](https://github.com/moby/moby/releases/tag/docker-v29.4.0), [29.3.0](https://github.com/moby/moby/releases/tag/docker-v29.3.0), [29.2.0](https://github.com/moby/moby/releases/tag/docker-v29.2.0)))
+- sysext-incus: xdelta ([3.2.0](https://github.com/jmacd/xdelta/releases/tag/v3.2.0))
+- sysext-podman: container-libs ([0.69.0](https://github.com/podman-container-tools/container-libs/releases/tag/common%2Fv0.69.0))
+- sysext-python: distlib ([0.4.3](https://raw.githubusercontent.com/pypa/distlib/refs/tags/0.4.3/CHANGES.rst))
+- sysext-python: msgpack ([1.2.1](https://github.com/msgpack/msgpack-python/releases/tag/v1.2.1) (includes [1.2.0](https://github.com/msgpack/msgpack-python/releases/tag/v1.2.0)))
+- sysext-python: setuptools-scm ([10.1.2](https://github.com/pypa/setuptools-scm/releases/tag/setuptools-scm-v10.1.2) (includes [10.1.1](https://github.com/pypa/setuptools-scm/releases/tag/setuptools-scm-v10.1.1), [10.1.0](https://github.com/pypa/setuptools-scm/releases/tag/setuptools-scm-v10.1.0)))
+- sysext-python: typing-extensions ([4.16.0](https://raw.githubusercontent.com/python/typing_extensions/refs/tags/4.16.0/CHANGELOG.md))
+- sysext-python: vcs-versioning ([2.2.2](https://github.com/pypa/setuptools-scm/releases/tag/vcs-versioning-v2.2.2) (includes [2.2.1](https://github.com/pypa/setuptools-scm/releases/tag/vcs-versioning-v2.2.1), [2.2.0](https://github.com/pypa/setuptools-scm/releases/tag/vcs-versioning-v2.2.0), [2.1.0](https://github.com/pypa/setuptools-scm/releases/tag/vcs-versioning-v2.1.0), [2.0.0](https://github.com/pypa/setuptools-scm/releases/tag/vcs-versioning-v2.0.0)))
+- sysext-zfs: zfs ([2.4.3](https://github.com/openzfs/zfs/releases/tag/zfs-2.4.3) (includes [2.4.2](https://github.com/openzfs/zfs/releases/tag/zfs-2.4.2), [2.4.1](https://github.com/openzfs/zfs/releases/tag/zfs-2.4.1), [2.4.0](https://github.com/openzfs/zfs/releases/tag/zfs-2.4.0)))

sdk_container/src/third_party/coreos-overlay/app-admin/etcd-wrapper/etcd-wrapper-3.5.16.ebuild → sdk_container/src/third_party/coreos-overlay/app-admin/etcd-wrapper/etcd-wrapper-3.6.11.ebuild

@@ -15,10 +15,7 @@ KEYWORDS="amd64 arm64"
 RDEPEND=">=app-admin/sdnotify-proxy-0.1.0"
 
 src_install() {
-	local tag="v${PV}"
-	if [[ "${ARCH}" != "amd64" ]]; then
-		tag+="-${ARCH}"
-	fi
+	local tag="v${PV}-${ARCH}"
 
 	exeinto /usr/lib/flatcar
 	doexe "${FILESDIR}"/etcd-wrapper

sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-dns/bind

@@ -1,5 +1,5 @@
 # Keep only tool binaries and libraries those binaries need.
-ndb_install_mask="
+INSTALL_MASK+="
         /etc
         /var
         /usr/bin/arpaname
@@ -13,15 +13,10 @@ ndb_install_mask="
         /usr/sbin
 "
 
-INSTALL_MASK+="${ndb_install_mask}"
-PKG_INSTALL_MASK+="${ndb_install_mask}"
-
-unset ndb_install_mask
-
 # Override fowners to ignore changing owner or group to named. The
 # only files that this happens for are files that we have put into
-# {PKG_,}INSTALL_MASK. This will help us avoid installing
-# acct-user/named and acct-group/named.
+# INSTALL_MASK. This will help us avoid installing acct-user/named and
+# acct-group/named.
 if [[ -z ${flatcar_hacked_fowners:-} ]]; then
     flatcar_hacked_fowners=$(command -v fowners)
 fi
@@ -35,10 +30,10 @@ fowners() {
 # The pkg_postinst phase function wants to generate an rndc.key file
 # with /usr/sbin/rndc-confgen script if the key file is missing, then
 # change the ownership to the named group. We don't need the key file
-# at all as it's presumably for named. Also, we masked the installtion
-# of the script. Thus we fool the phase function by putting an empty
-# key file there, so the function won't trigger the generation. We
-# drop the key file later too.
+# at all as it's presumably for named. Also, we masked the
+# installation of the script. Thus we fool the phase function by
+# putting an empty key file there, so the function won't trigger the
+# generation. We drop the key file later too.
 cros_pre_pkg_postinst_add_fake_rndc_key() {
     local dir="${EROOT}/etc/bind"
     if [[ ! -d "${dir}" ]]; then

sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/diffutils

@@ -0,0 +1,5 @@
+cros_post_src_prepare_no_docs_and_tests() {
+    # Do not build tests nor docs. Building docs involves running the
+    # built diff3, which is an additional hurdle when cross-compiling.
+    sed -i -e 's/ tests\b//' -e 's/ doc\b//' -e 's/ man\b//' -e 's/ gnulib-tests\b//' Makefile.in
+}

sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-block/thin-provisioning-tools

@@ -5,3 +5,11 @@ export ECARGO_EXTRA_ARGS=--no-default-features
 # read-only so that it forcibly overrides the ebuild. Note that this doesn't
 # avoid pulling in another rust(-bin) version, but it does avoid it being used.
 declare -gr RUST_NEEDS_LLVM=
+
+# Avoid using incompatible rust-bin. Our dev-lang/rust build is
+# configured for cross-compiling, while dev-lang/rust-bin is not. The
+# latter will be pulled in because of RUST_NEEDS_LLVM=1, but we don't
+# need LLVM for our build. The env change above avoids using rust-bin,
+# but it cannot avoid pulling it in. This change does that. Probably
+# makes RUST_NEEDS_LLVM override unnecessary, but whatever.
+declare -gra LLVM_COMPAT=( {19..22} )

sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-fs/lvm2

@@ -0,0 +1,7 @@
+cros_post_src_install_tmpfiles_perms() {
+    # Upstream installs its tmpfiles config file with unnecessarilly
+    # restrictive mode, relax it. It could be also fixed by passing
+    # --enable-write_install option to configure script, but that
+    # would affect a lot of other files too.
+    fperms 0644 /usr/lib/tmpfiles.d/lvm2.conf
+}

sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-fs/zfs

@@ -1,3 +1,15 @@
+# This addresses an issue with the kernel version compatibility check
+#  when installing zfs modules to /build/<arch> (e.g. via build_packages)
+#  from its binpkg (i.e. not recompiling it).
+SKIP_KERNEL_BINPKG_ENV_RESET=1
+
+# Necessary to prevent KV_FULL & KV_OUT_DIR from being unset
+# when building Kernel modules for sysext. See also eclass/linux-info.eclass.
+cros_pre_pkg_setup_kernel_version() {
+    LINUX_INFO_BINARY_RESET=1
+    get_version
+}
+
 cros_post_src_install_rm_systemd_masks() {
 	rm "${D}$(systemd_get_systemunitdir)"/zfs-load-key.service
 	rm "${D}$(systemd_get_systemunitdir)"/zfs-import.service

sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit

@@ -1,7 +1,12 @@
 # Do not install Gentoo-provided audit rules, we will install our own
 # in coreos-base/misc-files. Also skip installing legacy initscripts
 # stuff in /usr/libexec.
-audit_install_mask=" /etc/audit/audit.rules* /usr/libexec "
-INSTALL_MASK+="${audit_install_mask}"
-PKG_INSTALL_MASK+="${audit_install_mask}"
-unset audit_install_mask
+INSTALL_MASK+=" /etc/audit/audit.rules* /usr/libexec "
+
+cros_post_src_install_audit_flatcar_modifications() {
+    # Upstream installs its tmpfiles config file with unnecessarilly
+    # restrictive mode, relax it.
+    #
+    # https://github.com/linux-audit/audit-userspace/pull/547
+    fperms 0644 /usr/lib/tmpfiles.d/audit.conf
+}

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/app-arch/bzip2/0001-bzip2recover-CVE-2026-42250.patch

@@ -0,0 +1,31 @@
+From 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67 Mon Sep 17 00:00:00 2001
+From: Mark Wielaard <mark@klomp.org>
+Date: Thu, 28 May 2026 16:15:45 +0200
+Subject: [PATCH] bzip2recover: Make sure to not process more than
+ BZ_MAX_HANDLED_BLOCKS
+
+There is an off-by-one in the check before calling tooManyBlocks. This
+causes the scanning loop to run one more time and cause a possible
+read or write one past the global bStart, bEnd, rbStart and rbEnd
+buffers. There are no known exploits of this issue and you will need
+to compile with something like gcc -fsanitize=address (ASAN
+AddressSanitizer) to observe the faulty read/write.
+
+This has been assigned CVE-2026-42250.
+---
+ bzip2recover.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/bzip2recover.c b/bzip2recover.c
+index a8131e0..4b1c219 100644
+--- a/bzip2recover.c
++++ b/bzip2recover.c
+@@ -402,7 +402,7 @@ Int32 main ( Int32 argc, Char** argv )
+             rbEnd[rbCtr] = bEnd[currBlock];
+             rbCtr++;
+          }
+-         if (currBlock >= BZ_MAX_HANDLED_BLOCKS)
++         if (currBlock >= BZ_MAX_HANDLED_BLOCKS - 1)
+             tooManyBlocks(BZ_MAX_HANDLED_BLOCKS);
+          currBlock++;
+

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/app-arch/bzip2/README.md

@@ -0,0 +1,2 @@
+The patch `0001-bzip2recover-CVE-2026-42250.patch` can be dropped when
+updating to 1.0.9.