[AUTO-CHERRYPICK] [AutoPR- Security] Patch flannel for CVE-2026-73500 [HIGH] - branch 3.0-dev

[azurelinux-ci-jwt-app]

This is an auto-generated pull request to cherry-pick commit 1127304 to 3.0-dev. Original PR: #18455
In case of no merge conflicts, the PR is merged without approval because it's an automated cherry-pick of an already approved PR.
In case of merge conflicts, an AI-based conflict resolver will attempt to resolve conflicts and might make mistakes. The reviewer must check AI's work before approving.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[azurelinux-ci-jwt-app]

Auto Cherry-Pick SPEC Validation Summary

flannel SPEC summary

	Source (fasttrack)	Target (3.0-dev)	Resolved
Version	0.24.2	0.24.2	None
Release	30	30	None
Patches	10	9	14
Conflict	Yes

⚠️ Validation issues:

• Version-release None-None is not higher than Source 0.24.2-30
• Version-release None-None is not higher than Target 0.24.2-30
• Patch line found after BuildRequires/Requires: Patch6: CVE-2026-32241.patch
• Directive present in both Source and Target was dropped: BuildRequires: gcc
• Directive present in both Source and Target was dropped: BuildRequires: glibc-devel
• Directive present in both Source and Target was dropped: BuildRequires: golang < 1.25
• Directive present in both Source and Target was dropped: BuildRequires: kernel-headers
• Directive present in both Source and Target was dropped: Source0: https://github.com/flannel-io/%{name}/archive/refs/tags/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
• Directive present in both Source and Target was dropped: Source1: %{name}-%{version}-vendor.tar.gz

---

⚠️ Manual review required — validation found issues that may need correction.

[jslobodzian]

The auto cherry-pick garbled flannel.spec (deleted Version:/Release: from the preamble, moved %changelog into the header, and duplicated Patch6–Patch9 into %files), which failed the spec-lint / signature / SRPM-dup checks.

Manually repaired by rebuilding from the canonical fasttrack/3.0 spec (Release 30 + CVE-2026-73500 at Patch9) and reconciling the two 3.0-dev-only deltas:

• kept glibc-static >= 2.38-21 (the 3.0-dev rebuild bump),
• re-sequenced the 3.0-dev "Bump to rebuild with updated glibc" entry on top as 0.24.2-31 (date moved forward to Aug 19 so it sits above the fast-track -30 CVE entry), Release bumped to 31.

Result: preamble intact, patches Patch0–Patch9 sequential, %changelog strictly descending (31 > 30 > 29 …). No functional change to the CVE patch itself.