[High] Patch moby-engine for CVE-2026-61711, CVE-2026-61712, CVE-2026-75593, CVE-2026-17106

[jykanase]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

Patch for CVE-2026-61711, CVE-2026-61712, CVE-2026-75593, CVE-2026-17106

Change Log

• moby-engine.spec
• CVE-2026-61711.patch
• CVE-2026-61712.patch
• CVE-2026-75593.patch
• CVE-2026-17106.patch

Does this affect the toolchain?

No

Associated issues

• #xxxx

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-2026-61711
• https://nvd.nist.gov/vuln/detail/CVE-2026-61712
• https://nvd.nist.gov/vuln/detail/CVE-2026-75593
• https://nvd.nist.gov/vuln/detail/CVE-2026-17106

Test Methodology

• Local Build

• Patch application during build

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[jykanase]

CVE-2026-61712:

• Upstream Reference: moby/buildkit@69a3924
• Patch Applies cleanly.

CVE-2026-61711:

• Upstream Reference: moby/buildkit@3ea6dd0
• Following test files are not present in the azl moby-engine-25.0.3 source code:
  client/build_test.go
  client/client_test.go
  client/llb/exec_test.go
  executor/oci/spec_freebsd.go
• executor/oci/spec_darwin.go, executor/oci/spec_linux.go files do not contain affected code.

CVE-2026-75593:

• Upstream Reference: tonistiigi/fsutil@30cd4fc
• Patch Applies cleanly.

CVE-2026-17106:

• Upstream Reference: archive: harden tar extraction against path traversal moby/go-archive#45
• AZL moby-engine-25.0.3 source code does not contain time_nonwindows.go and time_windows.go
• Uses pathpkg to avoid old identifier collisions; replaces Go 1.26 APIs such as SplitSeq; adapts the older ID-mapping and timestamp APIs.
• Filesystem operations are performed through os.Root.

Buddy Build has passed.

[jykanase]

Buddy Build after recent changes.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[jslobodzian]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
1 pipeline(s) were filtered out due to trigger conditions.

[Akhila Guruju (akhila-guruju)]

Regarding CVE-2026-17106,
We might need to include the commit, moby/go-archive@9e6d2c7
PR moby/go-archive#45 on its own is secure but introduces a breaking change: extraction through a pre-existing absolute symlink (e.g. /var/run -> /run from a lower layer) is wrongly rejected with path escapes from parent, which breaks legitimate docker pull / build / cp for common base images (regression moby/moby#53258). 9e6d2c7 fixes that regression without reopening the breakout.

Shipping only moby/go-archive#45 leaves the package secure but functionally broken for downstream users, so both must go in together.

[Akhila Guruju (akhila-guruju)]

Regression in CVE-2026-17106.patch is fixed after recent changes. Patch LGTM.
Buddy Build after recent changes.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.