[AutoPR- Security] Patch kata-containers for CVE-2026-25800 [MEDIUM]

[Azure Linux Security Servicing Account (azurelinux-security)]

Auto Patch kata-containers for CVE-2026-25800.

Autosec pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1174807&view=results

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

What does the PR accomplish, why was it needed?

• Auto Patch kata-containers for CVE-2026-25800 (MEDIUM).

Change Log

• CVE-2026-25800

Does this affect the toolchain?

YES/NO

Associated issues

• N/A

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-2026-25800

Test Methodology

• Pipeline build id: Buddy Build URL

[v-swapsahu]

Patch Analysis — CVE-2026-25800 (kata-containers)
Backported: Yes

What the upstream fix does

Changes Assembler::insert() to return Result <(), TooManyChunks> instead of (), erroring out once the buffer accumulates more than 1024 chunks after defragmentation. This guards against a DoS where a malicious peer sends many small/gapped stream frames to force unbounded chunk accumulation. The two call sites — connection/mod.rs (crypto stream) and connection/streams/recv.rs (regular streams) — are updated to propagate the new error as TransportError::INTERNAL_ERROR.

Patch adjustments made:

• assembler.rs was updated to match the upstream implementation exactly.

• All three affected files (assembler.rs, mod.rs, streams/recv.rs) were corrected to reference the single, unified vendor/quinn-proto/... path — the actual vendor tree used at build time — replacing the original AI-generated patch's inconsistent/duplicated paths across separate vendor trees.

The change is functionally correct and matches upstream's intended fix. No logic deviates beyond the necessary path correction.

Buddy Build Pipelines - Run PR-18309+kata-containers+unknown has been triggered and it has passed.

[Kanishk Bansal (Kanishk-Bansal)]

kata-containers packages (the vulnerable QUIC assembler path is never built)
check again