feat(cozystack): disable KVM nested virtualization in Talos skills (CVE-2026-53359)#17
Conversation
…VE-2026-53359) Prescribe kvm_intel.nested=0 and kvm_amd.nested=0 via machine.install.extraKernelArgs in the talos-bootstrap node overlay, add a Phase 7 review check and a post-upgrade verification, to mitigate CVE-2026-53359 (Januscape). Placing the args under machine.install makes talm re-apply them on every upgrade so the mitigation survives OS bumps. Signed-off-by: Andrei Kvapil <kvapss@gmail.com> Assisted-By: Claude <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 56 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request implements mitigations for CVE-2026-53359 by disabling KVM nested virtualization across the Talos bootstrap configuration, manual installation steps, and post-upgrade checks. The feedback correctly identifies an error in the post-upgrade verification command, which incorrectly uses 'talm' instead of 'talosctl' to read /proc/cmdline.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
|
|
||
| # 6. CVE-2026-53359 mitigation survived the OS upgrade (nested virtualization still off). | ||
| # machine.install.extraKernelArgs is re-applied by `talm upgrade`; confirm per node: | ||
| talm -n <node-ip> read /proc/cmdline | grep -o 'kvm_intel.nested=[01]' # expect kvm_intel.nested=0 |
There was a problem hiding this comment.
The command uses talm to read /proc/cmdline, but talm does not have a read command. Direct node file reading is performed using talosctl.
| talm -n <node-ip> read /proc/cmdline | grep -o 'kvm_intel.nested=[01]' # expect kvm_intel.nested=0 | |
| talosctl -n <node-ip> read /proc/cmdline | grep -o 'kvm_intel.nested=[01]' # expect kvm_intel.nested=0 |
…lout (CVE-2026-53359) kvm_intel/kvm_amd are built into the Talos kernel, so nested= is settable only from the kernel command line. Pin grubUseUKICmdline=false (Talos >=1.12) so extraKernelArgs land on the built cmdline, and note the args take effect via talm upgrade, not a plain apply. Signed-off-by: Andrei Kvapil <kvapss@gmail.com> Assisted-By: Claude <noreply@anthropic.com>
IvanHunters
left a comment
IvanHunters
left a comment
There was a problem hiding this comment.
LGTM. The skill/docs guidance is internally consistent, places the kernel args under machine.install (re-applied by talm upgrade), and the verify step greps /proc/cmdline.
## Summary Publishes a security advisory blog post for **CVE-2026-53359 ("Januscape")**, a KVM guest-to-host escape that affects all current Talos kernels. ## What - New page bundle `content/en/blog/2026-07-07-security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/` with `index.md` and a banner image. - Explains the vulnerability, who is affected (clusters running VMs / tenant Kubernetes), the risk, and the recommended mitigation: disable nested virtualization via Talos `machine.install` kernel args (and the generic-Linux equivalent). - Links to the automation PR (`cozystack/ccp#17`) and the `cozystack:talos-bootstrap` / `cozystack:cluster-upgrade` skills. ## Why An exploit is public and no fixed Talos image has shipped yet, so operators need the mitigation now. Publishing it on the blog gives the community an authoritative, linkable reference. ## Preview - Author: Cozystack Team - Date: 2026-07-07 - OG image: `cve-2026-53359-banner.png` (1200×627) - Follows the existing blog conventions (page bundle, frontmatter, figure shortcode, "Join the community" block).
talm rejects the -n shorthand (unknown shorthand flag: 'n'); non-config subcommands need explicit --nodes and --endpoints. Use the long flags so the documented verification command actually runs. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
Aleksei Sviridkin (lexfrei)
left a comment
Aleksei Sviridkin (lexfrei)
left a comment
There was a problem hiding this comment.
LGTM — CI green. The post-upgrade verification now uses valid talm flags (--nodes/--endpoints) instead of the rejected -n shorthand.
Aleksei Sviridkin (lexfrei)
deleted the
security/cve-2026-53359-disable-nested-virt
branch
3 participants
Summary
Prescribes disabling KVM nested virtualization in the
cozystackplugin's Talos skills, to mitigate CVE-2026-53359 ("Januscape"), a guest-to-host escape in the Linux KVM/x86 shadow MMU (a use-after-free inkvm_mmu_get_child_sp()from shadow-page role confusion).The vulnerable code path is only reachable when a guest is allowed to use nested virtualization; disabling it on the host removes the attack surface regardless of the node kernel patch level. Fixed upstream in
81ccda30b4e8/ stable 6.12.95, 6.6.144, 6.1.177, 6.18.38, 7.1.3 (2026-07-04); no released Talos ships the fixed kernel yet.Change
talos-bootstrapskill: the generatednodes/<name>.yamloverlay now setskvm_intel.nested=0andkvm_amd.nested=0undermachine.install.extraKernelArgs, and Phase 7 review verifies they are present.talos-bootstrapreference (manual-steps.md): the node-config example documents the same.cluster-upgradereference (post-upgrade-checks.md): adds a post-upgrade check that the args are still on the kernel command line.Placing the args under
machine.installis deliberate:talmre-applies that section on everytalm upgrade, so the mitigation survives OS image bumps (and each apply/upgrade reboots the node). Both args are set so one config covers Intel and AMD.The canonical source is the cozystack
talmpreset (linked below); this repo makes the skills prescribe and verify it.Part of a coordinated set of PRs (see Related PRs below).
Related PRs
Coordinated CVE-2026-53359 (Januscape) nested-virtualization mitigation across Cozystack repos:
cozystack/genericpresets (canonical source)