containerd crash bugs and Istio auth bypass

The lead

containerd crashes on an image manifest with a malformed digest plus the subject annotation, reachable via default CRI PullImage. Patch containerd and avoid pulling untrusted images until then.

github.com/containerd

Also this week

• istio: AuthorizationPolicy method rules are bypassed over HTTP/2 by changing the method case (GHSA-w44g-8m76-8gc5)

  Istio AuthorizationPolicy method rules are case-sensitive, so an HTTP/2 request with a different method case bypasses DENY or notMethods rules. Check policies relying on method matching and upgrade Istio.

  github.com/istio

• Seven stable kernels for Thursday with fix for critical vulnerability

  Seven stable kernels fix CVE-2026-99999, where bad IPv4 checksum metadata in skb_checksum_help() can corrupt network traffic. Update container host kernels to the listed stable versions.

  lwn.net

Our take: CVSS is a severity, not a work order

CVSS says how bad a CVE is if it can be exploited. It doesn't know whether the vulnerable code ever ran in your cluster.

Is the vulnerable library even mapped into the running process?

kubectl exec <pod> -- \
  cat /proc/1/maps \
  | awk '{print $6}' \
  | grep '\.so' | sort -u

Not in the list: PID 1 isn't using it right now. Not proof of safety, but a better first question than the score.

Why CVSS Scores Fail Platform Teams and What Runtime Reachability Fixes