From 3dbe352d1b70fd1fe4c2e906949fe45aea3d9543 Mon Sep 17 00:00:00 2001
From: Julian Sommer <115516918+juliansommer@users.noreply.github.com>
Date: Mon, 19 Oct 2026 14:04:27 +1100
Subject: [PATCH] fix: ship patched guest kernels in system AMIs and the LB
 microVM (#1222)

build-system-image.sh never upgraded the base cloud image, so every Alpine
system AMI kept the kernel its base image was released with. Run apk upgrade
before installing manifest packages so rebuilt AMIs carry the branch's current
linux-virt (6.18.57-r0 on 3.24, 6.12.113-r0 on 3.21; CVE-2026-99999).

The ELBv2 microVM defaulted to Alpine 3.20, which is EOL and will never get a
fixed kernel. Default to 3.24.
---
 scripts/build-microvm-image.sh | 2 +-
 scripts/build-system-image.sh  | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/scripts/build-microvm-image.sh b/scripts/build-microvm-image.sh
index d092cf704..8bd89c1bf 100755
--- a/scripts/build-microvm-image.sh
+++ b/scripts/build-microvm-image.sh
@@ -17,7 +17,7 @@ BUILD_DIR="$REPO_ROOT/build/microvm"
 INIT_SH="$BUILD_DIR/init.sh"
 INITTAB="$BUILD_DIR/inittab"
 
-ALPINE_VERSION="${ALPINE_VERSION:-3.20}"
+ALPINE_VERSION="${ALPINE_VERSION:-3.24}"
 ALPINE_MIRROR="${ALPINE_MIRROR:-https://dl-cdn.alpinelinux.org/alpine}"
 # haproxy: ALB (L7) data plane. nginx + nginx-mod-stream: NLB (L4) data plane —
 # the `stream` module (a separate Alpine package) load-balances TCP/UDP/TLS,
diff --git a/scripts/build-system-image.sh b/scripts/build-system-image.sh
index e2c882fa7..987d8572a 100755
--- a/scripts/build-system-image.sh
+++ b/scripts/build-system-image.sh
@@ -284,6 +284,9 @@ if [[ "$DISTRO" == "alpine" ]] && [[ -n "${APK_PACKAGES:-}" ]]; then
     CUST+=(--run-command 'sed -i "s|^#\(.*community\)|\1|" /etc/apk/repositories 2>/dev/null || true')
     CUST+=(--run-command 'grep -q community /etc/apk/repositories || grep main /etc/apk/repositories | head -1 | sed "s|/main|/community|" >> /etc/apk/repositories')
     CUST+=(--run-command 'apk update')
+    # The base cloud image's kernel is only as fresh as its release; upgrade so
+    # the AMI ships the branch's current linux-virt and security fixes.
+    CUST+=(--run-command 'apk upgrade')
     CUST+=(--run-command "apk add ${APK_PACKAGES}")
 elif [[ "$DISTRO" == "ubuntu" ]] && [[ -n "${APT_PACKAGES:-}" ]]; then
     echo "Will install packages: ${APT_PACKAGES}"