[Kavya Sree Kaitepalli (KavyaSree2610)]

Merge Checklist

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

Upgrades rust to 1.98.1, bootstrapped via a new rust-bootstrap 1.97.1 stage0 toolchain, and re-evaluates/rebases the full set of downstream CVE patches against the new source tree. Also backports an upstream rustix fix needed for kata-containers-cc and tardev-snapshotter to keep building against the newer rustc.

Change Log

• rust: 1.96.1 -> 1.98.1; stage0_version/release_date bumped to 1.97.1 / 2026-07-16
• rust-bootstrap: 1.95.0 -> 1.97.1 stage0 toolchain, updated rust-bootstrap.signatures.json
• kata-containers-cc: 3.15.0.aks0-18 -> 3.15.0.aks0-19; backported upstream bytecodealliance/rustix#1663 (rustix-remove-rustc-attrs.patch) to build with the newer rustc. This patch was needed because kata-containers-cc (and tardev-snapshotter ) vendor an old copy of the rustix crate (0.37.x). That old version's build.rs probes for the unstable Rust feature #![feature(rustc_attrs)] , and if detected, enables a rustc_attrs cfg flag. When enabled, it applies internal/unstable compiler attributes - rustc_layout_scalar_valid_range_start / _end and rustc_nonnull_optimization_guaranteed - to Errno , BorrowedFd , and OwnedFd for niche-layout optimizations.

What changed in Rust 1.98.1: Starting around rustc 1.97 (rust-lang/rust#155433, #156510), as part of an ongoing migration to "pattern types," rustc stopped allowing these internal rustc_* attributes to be used by external (non-compiler) crates. So when the old vendored rustix tries to use them, the build now fails

• tardev-snapshotter: 3.2.0.tardev1-10 -> 3.2.0.tardev1-11; applied the same rustix backport manually against the cached rustix 0.37.27 sources (outside the main autosetup source tree)
• Added a license-file exception for the new rust-by-example search index output
• Updated cgmanifest.json with the new rust/rust-bootstrap versions and download URLs

rust CVE patches -fixed upstream by vendored dependency bumps in 1.98.1

• CVE-2025-53605 --Rust 1.98.1 pulls in fixed protobuf 3.7.2, which splits skip_group/merge_message into depth-checked variants, preventing uncontrolled recursion.
• CVE-2026-40034 -- Cargo in Rust 1.98.1 pulls in fixed gix-submodule 0.32.0, which verifies the update value didn't originate from .gitmodules before allowing a Command, closing the RCE bypass.
• CVE-2026-82251-- Cargo in Rust 1.98.1 pulls in fixed gix 0.85.0, which validates submodule names and rejects .. path-traversal segments before deriving submodule git directories.
• CVE-2026-82252 -- Cargo in Rust 1.98.1 pulls in fixed gix 0.85.0, which no longer follows symlinks when reading the worktree .gitmodules file.
• CVE-2026-82253 -- Cargo in Rust 1.98.1 pulls in fixed gix-validate 0.11.2, which replaces the single-match .. check with a full path-component scan, closing the traversal bypass.

rust CVE patches dropped
Existing Capstone-related patches removed(Capstone disassembler no longer in scope):

• CVE-2025-67873
• CVE-2025-68114
• CVE-2026-47143

Does this affect the toolchain?

NO

Workitems

https://microsoft.visualstudio.com/OS/_workitems/edit/64124157

Test Methodology

• Buddy build: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1202624&view=results
• Full build id: 3.0.20260914-kkaitepalli-1202623 (succeeded)
• Rust testing using crater: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1202746&view=results

No regressions found

[Muhammad Falak R Wani (mfrw)]

looks like we missed a changelog entry

[Kavya Sree Kaitepalli (KavyaSree2610)]

updated!

[Saul Paredes (Redent0r)]

do we need to bump kata to rebuild with rust, like in https://github.com/microsoft/azurelinux/pull/14819/changes#diff-112e7728297c4759e76cb3698e4292c2e2cbe3e708a6f3e5f7740cfc16eed86eR118 ?

[Kavya Sree Kaitepalli (KavyaSree2610)]

do we need to bump kata to rebuild with rust, like in https://github.com/microsoft/azurelinux/pull/14819/changes#diff-112e7728297c4759e76cb3698e4292c2e2cbe3e708a6f3e5f7740cfc16eed86eR118 ?

Full build is successful with new rust

[Muhammad Falak R Wani (mfrw)]

LGTM :)

[jslobodzian]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
1 pipeline(s) were filtered out due to trigger conditions.

[azurelinux-ci-jwt-app]

Auto cherry-pick results:

• 3.0-dev ✅ -> [AUTO-CHERRYPICK] rust: Upgrade rust to 1.98.1 - branch 3.0-dev #19363

Auto cherry-pick pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1226060&view=results