- [Changelog since v1.20.5](#changelog-since-v1205)
  - [Important Security Information](#important-security-information-1)
    - [CVE-2021-25735: Validating Admission Webhook does not observe some previous fields](#cve-2021-25735-validating-admission-webhook-does-not-observe-some-previous-fields)
  - [Changes by Kind](#changes-by-kind-9)
    - [API Change](#api-change-2)
    - [Feature](#feature-5)

preflight check `ContainerRuntimeVersion ` to validate if the installed container runtime supports the RuntimeConfig gRPC method. If the container runtime does not support the RuntimeConfig gRPC method, kubeadm will print a warning message. 
  
  Once Kubernetes 1.36 is released, the kubelet might refuse to start if the CRI runtime does not support this feature. More information can be found in https://kubernetes.io/blog/2025/09/12/kubernetes-v1-34-cri-cgroup-driver-lookup-now-ga/. ([#1...

   * Why? We want for queries like containsKey(null) to return false, but the
   * GWT SortedMap implementation that we delegate to throws
   * NullPointerException if the comparator does. Since our construction
   * methods ensure that null is never present in the map, it's OK for the
   * comparator to look for it wherever it wants.
   *

   *
   * @param arrays zero or more {@code short} arrays
   * @return a single array containing all the values from the source arrays, in order
   * @throws IllegalArgumentException if the total number of elements in {@code arrays} does not fit
   *     in an {@code int}
   */
  public static short[] concat(short[]... arrays) {
    long length = 0;
    for (short[] array : arrays) {
      length += array.length;
    }

   *
   * @param arrays zero or more {@code char} arrays
   * @return a single array containing all the values from the source arrays, in order
   * @throws IllegalArgumentException if the total number of elements in {@code arrays} does not fit
   *     in an {@code int}
   */
  public static char[] concat(char[]... arrays) {
    long length = 0;
    for (char[] array : arrays) {
      length += array.length;
    }

   *
   * @param arrays zero or more {@code short} arrays
   * @return a single array containing all the values from the source arrays, in order
   * @throws IllegalArgumentException if the total number of elements in {@code arrays} does not fit
   *     in an {@code int}
   */
  public static short[] concat(short[]... arrays) {
    long length = 0;
    for (short[] array : arrays) {
      length += array.length;
    }

- Changes behaviour of kube-proxy start; does not attempt to set specific `sysctl` values (which does not work in recent Kernel versions anymore in non-init namespaces), when the current sysctl values are already set higher. ([#103174](https://github.com/kubernetes/kubernetes/pull/103174), [@Napsty](https://github.com/Napsty))...

object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection. By default, node users are authorized for create and patch requests but not delete requests against their node object. Since the NodeRestriction admission controller does not prevent patching OwnerReferences, a compromised node could leverage this vulnerability to delete and then recreate...

     */
    public void initializeMultiChannel() throws IOException {
        // Check server capability
        if (!supportsMultiChannel()) {
            log.info("Server does not support multi-channel");
            return;
        }

        // Query network interfaces from server
        queryRemoteInterfaces();

        // Discover local interfaces

        crc0 = (crc0 >>> 8) ^ byteTable[(bb.get() ^ crc0) & 0xFF];
      }
      finished = true;
    }

    @Override
    protected HashCode makeHash() {
      if (!finished) {
        // processRemaining does teardown we always want to do -- the folding together of the four
        // rolling CRCs.  So we call it on an empty ByteBuffer if we didn't already.
        processRemaining(EMPTY);
      }