### Bug or Regression

- Add `/sys/devices/virtual/powercap` to default masked paths. It avoids the potential security risk that the ability to read these files may offer a power-based sidechannel attack against any workloads running on the same kernel. ([#125970](https://github.com/kubernetes/kubernetes/pull/125970), [@carlory](https://github.com/carlory)) [SIG Node]

Niranjan Hasabnis, Nolan Liu, Nouce, Oliver Hennigh, osdamv, Patrik Erdes,
Patryk Chrabaszcz, Pavel Christof, Penghao Cen, postBG, Qingqing Cao, Qingying
Chen, qjivy, Raphael, Rasmi, raymondxyang, Renze Yu, resec, Roffel, Ruben
Vereecken, Ryohei Kuroki, sandipmgiri, Santiago Castro, Scott Kirkland, Sean
Vig, Sebastian Raschka, Sebastian Weiss, Sergey Kolesnikov, Sergii Khomenko,

FFEC          ; mapped                 ; 2193          # 1.1  HALFWIDTH DOWNWARDS ARROW
FFED          ; mapped                 ; 25A0          # 1.1  HALFWIDTH BLACK SQUARE
FFEE          ; mapped                 ; 25CB          # 1.1  HALFWIDTH WHITE CIRCLE
FFEF..FFF8    ; disallowed                             # NA   <reserved-FFEF>..<reserved-FFF8>

aAAA,QACA,MAAA,QAMA,8HACE,MAAA,QhJ5DR,oIgJ+DU,MAAA,KAQJ,+HACE,MAAA,QhJxER,qIgJ2EU,MAAA,QAUF,gEAAA,gEAEE,MAAA,QAvFR,mCnJmxkDJ,6CADA,mImJ/wkDM,MAAA,QhJHJ,yCHyxkDF,mDADA,yImJlxkDQ,MAAA,QAKF,+CAAA,+CAEE,iBAAA,QACA,MAAA,QAKF,qFACE,iBAAA,QACA,aAAA,QAGF,oFAEE,iBAAA,4MnJmxkDR,iGACA,qEAFA,8CmJ9wkDI,8FAIE,aAAA,KAIA,+CACE,MAAA,QnJgxkDR,sDmJ7wkDM,6CAEE,iBAAA,QACA,aAAA,QACA,MAAA,KnJgxkDR,wDmJ7wkDM,+CAEE,iBAAA,KACA,aAAA,QACA,MAAA,QAMA,6HACE,MAAA,QhJ5DR,mIgJ+DU,MAAA,KAQJ,8HACE,MAAA,QhJxER,oIgJ2EU,MAAA,QAUF,+DA...

output has already been read. func (s *SHAKE) Write(p []byte) (n int, err error) { return s.d.Write(p) } func (s *SHAKE) Read(out []byte) (n int, err error) { fips140.RecordApproved() // Note that read is not exposed on Digest since SHA-3 does not offer // variable output length. It is only used internally by Sum. return s.d.read(out) } // Reset resets the hash to initial state. func (s *SHAKE) Reset() { s.d.Reset() if len(s.initBlock) != 0 { bytepadWrite(s, s.initBlock, s.d.rate) } } // Clone returns...

output has already been read. func (s *SHAKE) Write(p []byte) (n int, err error) { return s.d.Write(p) } func (s *SHAKE) Read(out []byte) (n int, err error) { fips140.RecordApproved() // Note that read is not exposed on Digest since SHA-3 does not offer // variable output length. It is only used internally by Sum. return s.d.read(out) } // Reset resets the hash to initial state. func (s *SHAKE) Reset() { s.d.Reset() if len(s.initBlock) != 0 { s.Write(bytepad(s.initBlock, s.d.rate)) } } // Clone returns...