SUSE-SU-2026:3428-1

Description of the patch:

This update for runc fixes the following issues:

Update to 1.3.6.

• CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem integrity violations (bsc#1268275).

Other updates and bugfixes:

• Version 1.3.6:
  • When masking directories with maskPaths, runc will now re- use a single tmpfs instance (which is not writeable) to reduce the number tmpfs superblocks that need to be reaped when containers die (in particular, Kubernetes applies masks to per-CPU sysfs directories which get expensive quickly).
• Version 1.3.5:
  • Recursive atime-related mount flags (rrelatime et al.) are now applied properly.
  • PR #4757 caused a regression that resulted in spurious cannot start a container that has stopped errors when running runc create and has thus been reverted.
  • Updated builds to Go 1.25, libseccomp v2.6.0.
  • Minor signing keyring updates.