diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/app-crypt/mit-krb5/0001-Fix-two-NegoEx-parsing-vulnerabilities.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/app-crypt/mit-krb5/0001-Fix-two-NegoEx-parsing-vulnerabilities.patch
deleted file mode 100644
index bd5e190c330..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/app-crypt/mit-krb5/0001-Fix-two-NegoEx-parsing-vulnerabilities.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From 2e75f0d9362fb979f5fc92829431a590a130929f Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Wed, 8 Apr 2026 17:57:59 -0400
-Subject: [PATCH] Fix two NegoEx parsing vulnerabilities
-
-In parse_nego_message(), check the result of the second call to
-vector_base() before dereferencing it.  In parse_message(), check for
-a short header_len to prevent an integer underflow when calculating
-the remaining message length.
-
-Reported by Cem Onat Karagun.
-
-CVE-2026-40355:
-
-In MIT krb5 release 1.18 and later, if an application calls
-gss_accept_sec_context() on a system with a NegoEx mechanism
-registered in /etc/gss/mech, an unauthenticated remote attacker can
-trigger a null pointer dereference, causing the process to terminate.
-
-CVE-2026-40356:
-
-In MIT krb5 release 1.18 and later, if an application calls
-gss_accept_sec_context() on a system with a NegoEx mechanism
-registered in /etc/gss/mech, an unauthenticated remote attacker can
-trigger a read overrun of up to 52 bytes, possibly causing the process
-to terminate.  Exfiltration of the bytes read does not appear
-possible.
-
-ticket: 9205 (new)
-tags: pullup
-target_version: 1.22-next
----
- lib/gssapi/spnego/negoex_util.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/lib/gssapi/spnego/negoex_util.c b/lib/gssapi/spnego/negoex_util.c
-index edc5462e8..a65238e57 100644
---- a/lib/gssapi/spnego/negoex_util.c
-+++ b/lib/gssapi/spnego/negoex_util.c
-@@ -253,6 +253,10 @@ parse_nego_message(OM_uint32 *minor, struct k5input *in,
-     offset = k5_input_get_uint32_le(in);
-     count = k5_input_get_uint16_le(in);
-     p = vector_base(offset, count, EXTENSION_LENGTH, msg_base, msg_len);
-+    if (p == NULL) {
-+        *minor = ERR_NEGOEX_INVALID_MESSAGE_SIZE;
-+        return GSS_S_DEFECTIVE_TOKEN;
-+    }
-     for (i = 0; i < count; i++) {
-         extension_type = load_32_le(p + i * EXTENSION_LENGTH);
-         if (extension_type & EXTENSION_FLAG_CRITICAL) {
-@@ -391,7 +395,8 @@ parse_message(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, struct k5input *in,
-     msg_len = k5_input_get_uint32_le(in);
-     conv_id = k5_input_get_bytes(in, GUID_LENGTH);
- 
--    if (in->status || msg_len > token_remaining || header_len > msg_len) {
-+    if (in->status || msg_len > token_remaining ||
-+        header_len < (size_t)(in->ptr - msg_base) || header_len > msg_len) {
-         *minor = ERR_NEGOEX_INVALID_MESSAGE_SIZE;
-         return GSS_S_DEFECTIVE_TOKEN;
-     }
--- 
-2.54.0
-
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/app-crypt/mit-krb5/README.md b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/app-crypt/mit-krb5/README.md
deleted file mode 100644
index 3a67399bf81..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/app-crypt/mit-krb5/README.md
+++ /dev/null
@@ -1,2 +0,0 @@
-The patch `0001-Fix-two-NegoEx-parsing-vulnerabilities.patch` can be
-dropped after updating to 1.22.3 or later.
diff --git a/sdk_container/src/third_party/gentoo b/sdk_container/src/third_party/gentoo
index a1662c61dc9..73ada196961 160000
--- a/sdk_container/src/third_party/gentoo
+++ b/sdk_container/src/third_party/gentoo
@@ -1 +1 @@
-Subproject commit a1662c61dc989f8a1ba90cd8de54b91c3f35a9de
+Subproject commit 73ada1969619900cff8a08cfb078995d6ce67591