Security update for libkrun

This security update for libkrun addresses several OpenSSL-related vulnerabilities: CVE-2025-24898 (use-after-free in ssl::select_next_proto), CVE-2026-41676 (short buffer overflow in Deriver:derive and PkeyCtxRef:derive), CVE-2026-41677 (out-of-bounds read in PEM password callback), CVE-2026-41678 (out-of-bounds write in aes::unwrap_key), CVE-2026-41681 (stack corruption in MdCtxRef::digest_final), CVE-2026-41898 (information leak via unchecked callback length in PSK and cookie trampolines), CVE-2026-42327 (undefined behavior in X509Ref::ocsp_responders with non-UTF-8 OCSP URLs), and CVE-2026-44662 (heap buffer overflow in AES key-wrap-with-padding encryption). These issues stem from improper memory handling and bounds checking in OpenSSL components used by libkrun. The update resolves these vulnerabilities by correcting lifetime management, buffer handling, and input validation.

The vulnerabilities could lead to memory corruption (use-after-free, buffer overflows, out-of-bounds reads/writes, stack corruption), information leakage to network peers, and undefined behavior when processing certain certificates. These issues may affect the confidentiality, integrity, and availability of cryptographic operations performed by libkrun. However, no known exploits in the wild have been reported, indicating limited active exploitation at this time.

A security update is available that addresses all listed vulnerabilities. Users should apply the official patch provided by the vendor to affected versions of libkrun. Since this is not a cloud service, remediation requires updating the affected software on-premises. No additional mitigation steps are indicated by the vendor advisory.