* SECURITY UPDATE: Permission Model file-system allow-list bypass via radix tree split nodes (CVE-2026-58043) - FSPermission::RadixTree::Node::CreateChild() unconditionally set child->is_leaf = true on the post-loop fallthrough whenever a newly inserted --allow-fs-read/--allow-fs-write path shared the whole (or a shorter) stored prefix of an existing tree node. That node is not necessarily something the caller ever explicitly granted: repeatedly inserting sibling paths that share a leading substring (for example /tmp/secret1, /tmp/secret2, /tmp/secret3) makes CreateChild() synthesize an intermediate node holding just the shared substring ("secret") as pure trie bookkeeping, with is_leaf left false; the vulnerable fallthrough could then mark that synthetic node itself as a granted leaf, so /tmp/secret became readable/writable even though it was never passed to --allow-fs-read/--allow-fs-write - debian/patches/CVE-2026-58043.patch: capture whether a node already qualified as an end node before CreateChild() walks through it, and only propagate is_leaf = true on the fallthrough when it already did; also tighten the loop's own split-boundary check from `i > prefix_len` to `i >= prefix_len` so a newly-inserted path shorter than the existing child's stored prefix is unambiguously treated as its own split point (upstream 440329f6247c, single commit shared by v22.23.2, v24.18.1 and v26.5.1; carried verbatim, zero adaptation needed for 23.11.1) - CVE-2026-58043