Description of the patch:
This update for kubevirt fixes the following issues:
- CVE-2026-9804: Symlink escape in the VMExport dir
handler let an attacker controlling an exported PVC read sensitive
files (TLS keys, tokens, service-account creds) from the exporter
pod. (bsc#1266733)
- CVE-2025-14525: A VM reporting many guest-internal
interfaces via the guest agent could flood VMI status and fill etcd
(denial of service). Caps reported interfaces at 10. (bsc#1256434)
- CVE-2026-35469: resource-exhaustion
in the SPDY/3 protocol implementation of
github.com/moby/spdystream. (GHSA-pc3f-x583-g7j2,bsc#1262265)