…VE-2025-62291 [HIGH] - branch 3.0-dev" #15541

Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>

…-2026-22801 [Medium] (#15492)

Co-authored-by: CBL-Mariner Servicing Account <cblmargh@microsoft.com>

…UM] (#15522)

Signed-off-by: Kanishk Bansal <kanbansal@microsoft.com>
Co-authored-by: Kanishk Bansal <kanbansal@microsoft.com>
Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>

Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>

Co-authored-by: bot-for-go[bot] <199222863+bot-for-go[bot]@users.noreply.github.com>

…6-21941, CVE-2026-21964, CVE-2026-21936, CVE-2026-21937 [Medium] (#15551)

Signed-off-by: Kanishk Bansal <kanbansal@microsoft.com>
Co-authored-by: Kanishk Bansal <kanbansal@microsoft.com>

Co-authored-by: bot-for-go[bot] <199222863+bot-for-go[bot]@users.noreply.github.com>

Co-authored-by: Archana Shettigar <v-shettigara@microsoft.com>

Co-authored-by: BinduSri-6522866 <v-badabala@microsoft.com>

Co-authored-by: akhila-guruju <v-guakhila@microsoft.com>
Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>

…26-0897 [HIGH] - branch 3.0-dev" #15568

Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
Co-authored-by: jslobodzian <joslobo@microsoft.com>

…025-61100,CVE-2025-61101,CVE-2025-61102,CVE-2025-61103,CVE-2025-61104,CVE-2025-61105,CVE-2025-61106 & CVE-2025-61107 - branch 3.0-dev" #15569

Co-authored-by: Archana Shettigar <v-shettigara@microsoft.com>

Co-authored-by: Suresh Babu Chalamalasetty <schalam@microsoft.com>

Co-authored-by: Kanishk Bansal <kanbansal@microsoft.com>

Co-authored-by: Kanishk Bansal <kanbansal@microsoft.com>

Co-authored-by: CBL-Mariner Servicing Account <cblmargh@microsoft.com>

…026-21637, CVE-2025-59466, CVE-2025-59465, CVE-2025-55132, CVE-2025-55131 [HIGH] - branch 3.0-dev" #15624

Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
Co-authored-by: BinduSri-6522866 <v-badabala@microsoft.com>
Co-authored-by: jslobodzian <joslobo@microsoft.com>

…-kata-containerd - branch 3.0-dev (#15623)

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
Signed-off-by: Aurélien Bombo <aurelien.bombo@microsoft.com>
Co-authored-by: Aurélien Bombo <aurelien.bombo@microsoft.com>
Co-authored-by: jslobodzian <joslobo@microsoft.com>

…2026-24747 [HIGH] - branch 3.0-dev" #15625

Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
Co-authored-by: jslobodzian <joslobo@microsoft.com>

Backports a fix for a credential leak vulnerability in containerd2's CRI error handling. When image pulls fail from private registries using URL-based authentication (e.g., Azure Blob Storage with SAS tokens), sensitive query parameters were being exposed in both containerd logs and Kubernetes pod events (visible via kubectl describe pod).

…onalization support in nodejs24 (#15385)

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…VE-2026-0672 [MEDIUM] (#15595)

…5498)

CONFIG_SQUASHFS_ZSTD

With this a better compression algo (zstd) becomes available to users, this is a read-only kernel feature with minimal overhead when not in use. Already enabled in our ARM kernel.

CONFIG_FW_CFG_SYSFS

Enables module that permits firmware config injection. Minimal overhead, not loaded when not in use. Already enabled in our ARM kernel

Co-authored-by: Jiri Appl <jiria@microsoft.com>

Co-authored-by: Archana Shettigar <v-shettigara@microsoft.com>

…VE-2025-66199, CVE-2025-68160, CVE-2025-69418, CVE-2025-69420, CVE-2025-69421 - branch 3.0-dev (#15627)

Co-authored-by: corvus-callidus <lyrydber@microsoft.com>
Co-authored-by: jslobodzian <joslobo@microsoft.com>

…RITICAL] - branch 3.0-dev (#15646)

Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
Co-authored-by: Kanishk Bansal <kanbansal@microsoft.com>
Co-authored-by: jslobodzian <joslobo@microsoft.com>

approving PR.  Buddy build and expected tests passed.

Co-authored-by: Kanishk Bansal <kanbansal@microsoft.com>

CVE-2026-22796 - branch 3.0-dev (#15698)

Co-authored-by: corvus-callidus <lyrydber@microsoft.com>
Co-authored-by: jslobodzian <joslobo@microsoft.com>

…-2025-69420, CVE-2025-69418, CVE-2025-68160 [HIGH] (#15702)

Co-authored-by: Kanishk Bansal <kanbansal@microsoft.com>

…-dev (#15660)

Co-authored-by: Rachel Menge <rachelmenge@microsoft.com>

…[HIGH] - branch 3.0-dev (#15703)

Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
Co-authored-by: jslobodzian <joslobo@microsoft.com>

…026-24882 [HIGH] - branch 3.0-dev" #15713

Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>