- Introduced the flag `--ipvs-strict-arp` to configure stricter ARP sysctls, defaulting to false to preserve existing behaviors. This was enabled by default in 1.13.0, which impacted a few CNI plugins. ([#75295](https://github.com/kubernetes/kubernetes/pull/75295), [@lbernail](https://github.com/lbernail))

* [IPVS] Allow for transparent kube-proxy restarts ([#75283](https://github.com/kubernetes/kubernetes/pull/75283), [@lbernail](https://github.com/lbernail))
* [IPVS] Introduces flag ipvs-strict-arp to configure stricter ARP sysctls, defaulting to false to preserve existing behaviors. This was enabled by default in 1.13.0, which impacted a few CNI plugins. ([#75295](https://github.com/kubernetes/kubernetes/pull/75295), [@lbernail](https://github.com/lbernail))

- Kubelet now hard rejects pods with AppArmor if the node does not have AppArmor. ([#125776](https://github.com/kubernetes/kubernetes/pull/125776), [@vinayakankugoyal](https://github.com/vinayakankugoyal))
- Mount-utils: treated syscall.ENODEV as corrupted mount. ([#126174](https://github.com/kubernetes/kubernetes/pull/126174), [@dobsonj](https://github.com/dobsonj))

ppc64le || s390x) && !purego && linux package nistec import ( "syscall" "testing" "unsafe" ) // Lightly adapted from the bytes test package. Allocate a pair of T one at the start of a page, another at the // end. Any access beyond or before the page boundary should cause a fault. This is linux specific. func dangerousObjs[T any](t *testing.T) (start *T, end *T) { pagesize := syscall.Getpagesize() b, err := syscall.Mmap(0, 0, 3*pagesize, syscall.PROT_READ|syscall.PROT_WRITE, syscall.MAP_ANONYMOUS|syscall.MAP_PRIVATE)...

ppc64le || s390x) && !purego && linux package nistec import ( "syscall" "testing" "unsafe" ) // Lightly adapted from the bytes test package. Allocate a pair of T one at the start of a page, another at the // end. Any access beyond or before the page boundary should cause a fault. This is linux specific. func dangerousObjs[T any](t *testing.T) (start *T, end *T) { pagesize := syscall.Getpagesize() b, err := syscall.Mmap(0, 0, 3*pagesize, syscall.PROT_READ|syscall.PROT_WRITE, syscall.MAP_ANONYMOUS|syscall.MAP_PRIVATE)...

- Mount-utils: treat syscall.ENODEV as corrupted mount ([#126174](https://github.com/kubernetes/kubernetes/pull/126174), [@dobsonj](https://github.com/dobsonj)) [SIG Storage]

// Submitted by Edwin Balani <******@****.***>
soc.srcf.net
user.srcf.net

// Studenten Net Twente : http://www.snt.utwente.nl/
// Submitted by Silke Hofstra <syscom@snt.utwente.nl>
utwente.io

// Sub 6 Limited: http://www.sub6.com
// Submitted by Dan Miller <******@****.***>
temp-dns.com

// Supabase : https://supabase.io

	SUBSS (R11), X11                        // f3450f5c1b
	SUBSS X2, X11                           // f3440f5cda
	SUBSS X11, X11                          // f3450f5cdb
	SWAPGS                                  // 0f01f8
	SYSCALL                                 // 0f05
	SYSENTER                                // 0f34
	SYSENTER64                              // 480f34
	SYSEXIT                                 // 0f35

8/GckFHgJ4/+1Kdz5oU/t2fAhXJNdgr0TyHk9yvi+aGvGi+ABg==","X-Minio-Internal-Server-Side-Encryption-Seal-Algorithm":"DAREv2-HMAC-SHA256","content-type":"application/octet-stream"}},{"Bucket":"buck1","Name":"go_113/src/cmd/vendor/golang.org/x/sys/unix/syscall.go","UserDef":{"X-Minio-Internal-Server-Side-Encryption-Iv":"QxO7pw0ijhd0iUWSP09z=","X-Minio-Internal-Server-Side-Encryption-S3-Kms-Key-Id":"my-minio-key","X-Minio-Internal-Server-Side-Encryption-S3-Kms-Sealed-Key":"IAAfAJXWQ0NEGvmAmHMk+qCSrg==",...

- Mount-utils: treat syscall.ENODEV as corrupted mount ([#126174](https://github.com/kubernetes/kubernetes/pull/126174), [@dobsonj](https://github.com/dobsonj)) [SIG Storage]