CVE-2025-0426: Node Denial of Service via kubelet Checkpoint API

The vulnerability occurs because the kubelet's Checkpoint API was exposed on an unauthenticated read-only HTTP endpoint. The provided patches (e.g., bda81f1b68e22671e5e26953f0086ac6fca9d8aa) show that the registration of the '/checkpoint' route, which is handled by the 's.checkpoint' method, was moved from the InstallDefaultHandlers function to the InstallDebuggingHandlers function. InstallDefaultHandlers sets up the unauthenticated read-only port, while InstallDebuggingHandlers typically sets up authenticated endpoints. Therefore, InstallDefaultHandlers was the function that incorrectly exposed the checkpointing functionality without authentication, and s.checkpoint (which resolves to k8s.io/kubernetes/pkg/kubelet/server.(*Server).checkpoint) is the function that processes these potentially malicious requests, leading to disk exhaustion.