The copy fail security flaw in the Linux kernel [1] has been fixed
in the following versions of Fedora CoreOS:
- stable 43.20260413.3.2 (released today)
- testing 44.20260419.2.1 (released 04/28)
- next 44.20260414.1.1 (released a few weeks ago)
Since there were multiple `stable` releases this week you may want
to force an update manually if you have a periodic update strategy
configured [2] as there is currently a bug [3] that can cause the already
staged older update to be the one that gets applied during your window.
To force an update now and immediately reboot into the update you can
run `sudo /usr/bin/zincati-update-now`.
The Fedora CoreOS Team
[1] https://github.com/coreos/fedora-coreos-tracker/issues/2140
[2] https://coreos.github.io/zincati/usage/updates-strategy/#periodic-strategy
[3] https://github.com/coreos/zincati/issues/928
Fedora Linux 44 has been released[1]. The Fedora CoreOS `testing` stream
has been rebased and is currently rolling out with version
`44.20260419.2.1`. This update will come to the `stable` stream in a few
weeks.
For more information about Fedora 44, see the Fedora Project's list of
official Changes [2] and the Fedora CoreOS analysis of each Change [3].
There are a few changes on the Fedora CoreOS side going into this release
that may require attention:
- Setting the `container_use_cephfs` and `virt_use_samba` SELinux booleans
to on has been dropped [4]. These knobs were historically set at the
request of OpenShift but are no longer necessary for Fedora CoreOS to set.
They now retain the default value shipped in Fedora RPMs. If you were
relying on these settings you may need to re-apply them after updating.
- The location of SSH authorized keys overlay files has moved in Fedora 44
[5][6]. Following the transition in Fedora 43 where `ssh-key-dir` was
replaced by an overlay, the location of these overlay files has been moved
again to better align with upstream standards. In Fedora 43, the
configuration was delivered by CoreOS at
`/etc/ssh/sshd_config.d/40-authorized-keys-file.conf`. In Fedora 44, the
configuration is delivered by the Ignition and Afterburn RPMs at
`/etc/ssh/sshd_config.d/90-afterburn-authorized-keys-file.conf` and
`/etc/ssh/sshd_config.d/91-ignition-authorized-keys-file.conf`. If you
previously updated any `AuthorizedKeysFile` config to handle the Fedora 43
change, you may need to update it again.
- Fedora CoreOS 44 ships with podman 5.8.0, which introduces an automatic
migration of the container database from BoltDB to SQLite [7][8]. BoltDB
support will be fully removed in Podman 6.0, expected to ship with Fedora
45 [9]. The migration is designed to happen automatically with no user
intervention. Most users will not notice any change in functionality.
Should you encounter any issues during this transition, please file an
upstream bug at https://github.com/containers/podman.
- The functionality from `nfs-utils-coreos` has been folded into a generic
`nfs-client-utils` package [10]. This is a non-breaking change — NFS client
mounts should continue to work as before.
Please test out the `testing` stream over the coming weeks and report any
issues in our issue tracker [11].
The Fedora CoreOS team.
[1] https://fedoramagazine.org/announcing-fedora-linux-44/
[2] https://fedoraproject.org/wiki/Releases/44/ChangeSet
[3] https://github.com/coreos/fedora-coreos-tracker/issues/2063
[4] https://github.com/coreos/fedora-coreos-config/pull/3997
[5] https://github.com/coreos/fedora-coreos-config/pull/3885
[6]
https://github.com/coreos/fedora-coreos-config/pull/3885#issuecomment-40131…
[7]
https://lists.fedoraproject.org/archives/list/coreos@lists.fedoraproject.or…
[8] https://github.com/coreos/fedora-coreos-tracker/issues/2110
[9] https://fedoraproject.org/wiki/Changes/Podman6
[10] https://github.com/coreos/fedora-coreos-config/pull/3680
[11] https://github.com/coreos/fedora-coreos-tracker