20 Aug 2026

#### Bug fixes

- ebpf: Fixed IPv6 session affinity entries being randomly deleted (or never expiring) due to a struct layout mismatch when Felix read the affinity timestamp, which could re-balance sticky connections to a different backend. [calico 13460](https://github.com/projectcalico/calico/pull/13460) (@tomastigera)
- Fixes an issue in nftables mode where IP set members could be left unprogrammed after the nftables table was deleted and recreated. [calico 13442](https://github.com/projectcalico/calico/pull/13442) (@caseydavenport)
- Fixes an issue in nftables mode where Felix could panic when reading back an IP set member it could not parse. [calico 13442](https://github.com/projectcalico/calico/pull/13442) (@caseydavenport)
- Fixes an issue where IP sets containing overlapping CIDRs could fail to program correctly in nftables mode after a member was removed. [calico 13441](https://github.com/projectcalico/calico/pull/13441) (@caseydavenport)
- Fixes CALICO_IPV6POOL_VXLAN being ignored in IPv6-only clusters where the IPv4 pool is disabled (CALICO_IPV4POOL_CIDR=none), which left the IPv6 pool without VXLAN encapsulation. [calico 13439](https://github.com/projectcalico/calico/pull/13439) (@caseydavenport)
- [eBPF] Fix a window in which a new connection to a local workload could skip that workload's ingress policy, when the connection was started while the workload's route was still being programmed. [calico 13390](https://github.com/projectcalico/calico/pull/13390) (@tomastigera)
- Fixed the bundled Envoy Gateway crash-looping on clusters whose Gateway API CRD set omits ListenerSet, TLSRoute or BackendTLSPolicy, such as OpenShift or GKE's managed Gateway API addon. [calico 13367](https://github.com/projectcalico/calico/pull/13367) (@electricjesus)
- Fixed a bug where Calico could advertise a Service IP over BGP from a node whose local endpoint was not Ready, causing connection failures. [calico 13255](https://github.com/projectcalico/calico/pull/13255) (@MichalFupso)
- Fixed a kernel dmesg spew ("could not enable bpf_trace_printk events") on eBPF-dataplane nodes running with kernel lockdown=confidentiality (e.g. Talos). [calico 13234](https://github.com/projectcalico/calico/pull/13234) (@tomastigera)
- Fixed a rare start-of-day deadlock that could prevent Felix from restarting when a restart-requiring configuration change (e.g. the node IP being set) arrived while Felix was still starting up. [calico 13215](https://github.com/projectcalico/calico/pull/13215) (@fasaxc)
- Fixed a latent bug where EnsureBlock could allocate an IPv6 block from the wrong IP pool when an explicit IPv6 pool selector was provided (Windows host-local IPAM block reservation). [calico 13215](https://github.com/projectcalico/calico/pull/13215) (@fasaxc)
- eBPF: fix state explosion in the BPF verifier (resulting in programs not loading) caused by debug logs on a certain path. [calico 13215](https://github.com/projectcalico/calico/pull/13215) (@fasaxc)
- eBPF dataplane: fix loss of connectivity to the Kubernetes API server service after the API server is unavailable for a period, when using bpfNetworkBootstrap. Felix no longer clears the API server service's NAT backend when its endpoints transiently empty, so connectivity recovers without a calico-node restart. [calico 13066](https://github.com/projectcalico/calico/pull/13066) (@lucastigera)
- Fixed a bug where Felix's periodic route resync did not detect (and repair) Calico-owned routes that had been modified in place by another process. Fixed unnecessary reprogramming of unchanged IPv6 multi-path routes on resync, and a corner case where removing an IPAM block route could trigger a spurious conntrack cleanup for a workload owning the block's network address. [calico 12959](https://github.com/projectcalico/calico/pull/12959) (@fasaxc)

#### Other changes

- Refresh the node-driver-registrar dependency patch to remediate CVEs (grpc v1.82.1, x/net, x/text). [calico 13520](https://github.com/projectcalico/calico/pull/13520) (@skoryk-oleksandr)
- Update bundled Envoy images (envoy-gateway v1.8.2, envoy-proxy v1.38.3) and refresh dependency patches to remediate CVEs. [calico 13502](https://github.com/projectcalico/calico/pull/13502) (@skoryk-oleksandr)
- The default CNI configuration now declares cniVersion 1.0.0 (previously 0.3.1), enabling Calico as a multus delegate on OpenShift 4.23+. Requires containerd v1.6+ or CRI-O v1.24+. [calico 13378](https://github.com/projectcalico/calico/pull/13378) (@sridhartigera)
- calicoctl cluster diags now collects additional cluster state (v3 API resources, Multus network-attachment-definitions, unsupported-annotation usage) and collects eBPF map dumps as machine-parseable JSON, falling back to legacy text output against older calico-node versions. [calico 13020](https://github.com/projectcalico/calico/pull/13020) (@tomastigera)