rust: Upgrade rust to 1.98.1

[Kavya Sree Kaitepalli (KavyaSree2610)]

Merge Checklist

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

Upgrades rust to 1.98.1, bootstrapped via a new rust-bootstrap 1.97.1 stage0 toolchain, and re-evaluates/rebases the full set of downstream CVE patches against the new source tree. Also backports an upstream rustix fix needed for kata-containers-cc and tardev-snapshotter to keep building against the newer rustc.

Change Log

• rust: 1.96.1 -> 1.98.1; stage0_version/release_date bumped to 1.97.1 / 2026-07-16
• rust-bootstrap: 1.95.0 -> 1.97.1 stage0 toolchain, updated rust-bootstrap.signatures.json
• kata-containers-cc: 3.15.0.aks0-18 -> 3.15.0.aks0-19; backported upstream bytecodealliance/rustix#1663 (rustix-remove-rustc-attrs.patch) to build with the newer rustc
• tardev-snapshotter: 3.2.0.tardev1-10 -> 3.2.0.tardev1-11; applied the same rustix backport manually against the cached rustix 0.37.27 sources (outside the main autosetup source tree)
• Added a license-file exception for the new rust-by-example search index output
• Updated cgmanifest.json with the new rust/rust-bootstrap versions and download URLs

rust CVE patches -fixed upstream by vendored dependency bumps in 1.98.1

• CVE-2025-53605 --Rust 1.98.1 pulls in fixed protobuf 3.7.2, which splits skip_group/merge_message into depth-checked variants, preventing uncontrolled recursion.
• CVE-2026-40034 -- Cargo in Rust 1.98.1 pulls in fixed gix-submodule 0.32.0, which verifies the update value didn't originate from .gitmodules before allowing a Command, closing the RCE bypass.
• CVE-2026-82251-- Cargo in Rust 1.98.1 pulls in fixed gix 0.85.0, which validates submodule names and rejects .. path-traversal segments before deriving submodule git directories.
• CVE-2026-82252 -- Cargo in Rust 1.98.1 pulls in fixed gix 0.85.0, which no longer follows symlinks when reading the worktree .gitmodules file.
• CVE-2026-82253 -- Cargo in Rust 1.98.1 pulls in fixed gix-validate 0.11.2, which replaces the single-match .. check with a full path-component scan, closing the traversal bypass.

rust CVE patches dropped
Existing Capstone-related patches removed(Capstone disassembler no longer in scope):

• CVE-2025-67873
• CVE-2025-68114
• CVE-2026-47143

Does this affect the toolchain?

NO

Test Methodology

• Buddy build: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1200625&view=results successful