SUSE-SU-2026:23047-1

This update for runc fixes the following issues:

• CVE-2026-41579: runc allows a malicious image with a /dev symlink to trigger limited host filesystem integrity violations (bsc#1268275).

Changes for runc:

• update to 1.3.6:

• Various integration test improvements. (#5222, #5237, #5226, #5229, #5239, #5249, #5269, #5287, #5295, #5304)
• When masking directories with maskPaths, runc will now re- use a single tmpfs instance (which is not writeable) to reduce the number tmpfs superblocks that need to be reaped when containers die (in particular, Kubernetes applies masks to per-CPU sysfs directories which get expensive quickly).

• update to 1.3.5

• Recursive atime-related mount flags (rrelatime et al.) are now applied properly. (#5115, #5098)
• PR #4757 caused a regression that resulted in spurious cannot start a container that has stopped errors when running runc create and has thus been reverted. (#5158, #5153, #5151, #4645, #4757)
• Updated builds to Go 1.25, libseccomp v2.6.0. (#5111, #5053)
• Minor signing keyring updates. (#5146, #5139, #5144, #5148)