From b5a99473874fbc9fe094b39e954fb5a72caa108d Mon Sep 17 00:00:00 2001 From: Andrei Kvapil Date: Tue, 7 Jul 2026 16:11:34 +0200 Subject: [PATCH 1/5] docs: disable KVM nested virtualization in Talos install configs (CVE-2026-53359) Add kvm_intel.nested=0 and kvm_amd.nested=0 to machine.install.extraKernelArgs in the Talos install machine-config examples across all docs versions, to mitigate CVE-2026-53359 (Januscape), a KVM guest-to-host escape reachable only when nested virtualization is exposed to the guest. Signed-off-by: Andrei Kvapil Assisted-By: Claude --- content/en/docs/next/install/kubernetes/talos-bootstrap.md | 4 ++++ content/en/docs/next/install/kubernetes/talosctl.md | 4 ++++ content/en/docs/v0/install/kubernetes/talos-bootstrap.md | 4 ++++ content/en/docs/v0/install/kubernetes/talosctl.md | 4 ++++ content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md | 4 ++++ content/en/docs/v1.0/install/kubernetes/talosctl.md | 4 ++++ content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md | 4 ++++ content/en/docs/v1.1/install/kubernetes/talosctl.md | 4 ++++ content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md | 4 ++++ content/en/docs/v1.2/install/kubernetes/talosctl.md | 4 ++++ content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md | 4 ++++ content/en/docs/v1.3/install/kubernetes/talosctl.md | 4 ++++ content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md | 4 ++++ content/en/docs/v1.4/install/kubernetes/talosctl.md | 4 ++++ content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md | 4 ++++ content/en/docs/v1.5/install/kubernetes/talosctl.md | 4 ++++ 16 files changed, 64 insertions(+) diff --git a/content/en/docs/next/install/kubernetes/talos-bootstrap.md b/content/en/docs/next/install/kubernetes/talos-bootstrap.md index 1678b79e..a568ab6e 100644 --- a/content/en/docs/next/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/next/install/kubernetes/talos-bootstrap.md @@ -65,6 +65,10 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/next/install/kubernetes/talosctl.md b/content/en/docs/next/install/kubernetes/talosctl.md index 7e9adc94..f4a8433f 100644 --- a/content/en/docs/next/install/kubernetes/talosctl.md +++ b/content/en/docs/next/install/kubernetes/talosctl.md @@ -85,6 +85,10 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v0/install/kubernetes/talos-bootstrap.md b/content/en/docs/v0/install/kubernetes/talos-bootstrap.md index 267e61b4..aee4a4a8 100644 --- a/content/en/docs/v0/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v0/install/kubernetes/talos-bootstrap.md @@ -69,6 +69,10 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v0/install/kubernetes/talosctl.md b/content/en/docs/v0/install/kubernetes/talosctl.md index 32a6dbf8..3d56452a 100644 --- a/content/en/docs/v0/install/kubernetes/talosctl.md +++ b/content/en/docs/v0/install/kubernetes/talosctl.md @@ -89,6 +89,10 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md index 479fe9bc..98fb2cb3 100644 --- a/content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md @@ -65,6 +65,10 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.0/install/kubernetes/talosctl.md b/content/en/docs/v1.0/install/kubernetes/talosctl.md index 4675df1e..18ef90b7 100644 --- a/content/en/docs/v1.0/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.0/install/kubernetes/talosctl.md @@ -85,6 +85,10 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md index b380163f..945f60b3 100644 --- a/content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md @@ -65,6 +65,10 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.1/install/kubernetes/talosctl.md b/content/en/docs/v1.1/install/kubernetes/talosctl.md index 3cf1b41a..24633032 100644 --- a/content/en/docs/v1.1/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.1/install/kubernetes/talosctl.md @@ -85,6 +85,10 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md index 19272544..a7597117 100644 --- a/content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md @@ -65,6 +65,10 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.2/install/kubernetes/talosctl.md b/content/en/docs/v1.2/install/kubernetes/talosctl.md index 0f451543..439013f0 100644 --- a/content/en/docs/v1.2/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.2/install/kubernetes/talosctl.md @@ -85,6 +85,10 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md index bc7b4743..697bd8e5 100644 --- a/content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md @@ -65,6 +65,10 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.3/install/kubernetes/talosctl.md b/content/en/docs/v1.3/install/kubernetes/talosctl.md index c3782f42..8ff9d124 100644 --- a/content/en/docs/v1.3/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.3/install/kubernetes/talosctl.md @@ -85,6 +85,10 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md index 297d6974..8a2cfbde 100644 --- a/content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md @@ -65,6 +65,10 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.4/install/kubernetes/talosctl.md b/content/en/docs/v1.4/install/kubernetes/talosctl.md index 1461d23b..2669c3d7 100644 --- a/content/en/docs/v1.4/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.4/install/kubernetes/talosctl.md @@ -85,6 +85,10 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md index da3ae158..e11575da 100644 --- a/content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md @@ -65,6 +65,10 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.5/install/kubernetes/talosctl.md b/content/en/docs/v1.5/install/kubernetes/talosctl.md index 046bd12b..0acc569e 100644 --- a/content/en/docs/v1.5/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.5/install/kubernetes/talosctl.md @@ -85,6 +85,10 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: From 68998575b5bfda7b0ba04bc4f08e61bd9a55541c Mon Sep 17 00:00:00 2001 From: Andrei Kvapil Date: Tue, 7 Jul 2026 20:25:58 +0200 Subject: [PATCH 2/5] docs: pin grubUseUKICmdline=false for Talos >=1.12 so kvm nested args apply (CVE-2026-53359) extraKernelArgs is rejected/ignored under the UKI cmdline on Talos >=1.12; pin grubUseUKICmdline=false in the >=1.12 docs (next, v1.3-v1.5) so the mitigation actually takes effect. Signed-off-by: Andrei Kvapil Assisted-By: Claude --- content/en/docs/next/install/kubernetes/talos-bootstrap.md | 3 +++ content/en/docs/next/install/kubernetes/talosctl.md | 3 +++ content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md | 3 +++ content/en/docs/v1.3/install/kubernetes/talosctl.md | 3 +++ content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md | 3 +++ content/en/docs/v1.4/install/kubernetes/talosctl.md | 3 +++ content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md | 3 +++ content/en/docs/v1.5/install/kubernetes/talosctl.md | 3 +++ 8 files changed, 24 insertions(+) diff --git a/content/en/docs/next/install/kubernetes/talos-bootstrap.md b/content/en/docs/next/install/kubernetes/talos-bootstrap.md index a568ab6e..cf6f8853 100644 --- a/content/en/docs/next/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/next/install/kubernetes/talos-bootstrap.md @@ -65,6 +65,9 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the + # Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI). + grubUseUKICmdline: false extraKernelArgs: # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - kvm_intel.nested=0 diff --git a/content/en/docs/next/install/kubernetes/talosctl.md b/content/en/docs/next/install/kubernetes/talosctl.md index f4a8433f..f8c1f9ee 100644 --- a/content/en/docs/next/install/kubernetes/talosctl.md +++ b/content/en/docs/next/install/kubernetes/talosctl.md @@ -85,6 +85,9 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the + # Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI). + grubUseUKICmdline: false extraKernelArgs: # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - kvm_intel.nested=0 diff --git a/content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md index 697bd8e5..e64e7280 100644 --- a/content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md @@ -65,6 +65,9 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the + # Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI). + grubUseUKICmdline: false extraKernelArgs: # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - kvm_intel.nested=0 diff --git a/content/en/docs/v1.3/install/kubernetes/talosctl.md b/content/en/docs/v1.3/install/kubernetes/talosctl.md index 8ff9d124..600254c4 100644 --- a/content/en/docs/v1.3/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.3/install/kubernetes/talosctl.md @@ -85,6 +85,9 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the + # Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI). + grubUseUKICmdline: false extraKernelArgs: # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - kvm_intel.nested=0 diff --git a/content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md index 8a2cfbde..cfffa40b 100644 --- a/content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md @@ -65,6 +65,9 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the + # Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI). + grubUseUKICmdline: false extraKernelArgs: # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - kvm_intel.nested=0 diff --git a/content/en/docs/v1.4/install/kubernetes/talosctl.md b/content/en/docs/v1.4/install/kubernetes/talosctl.md index 2669c3d7..7e2fc4cd 100644 --- a/content/en/docs/v1.4/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.4/install/kubernetes/talosctl.md @@ -85,6 +85,9 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the + # Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI). + grubUseUKICmdline: false extraKernelArgs: # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - kvm_intel.nested=0 diff --git a/content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md index e11575da..40d6db60 100644 --- a/content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md @@ -65,6 +65,9 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the + # Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI). + grubUseUKICmdline: false extraKernelArgs: # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - kvm_intel.nested=0 diff --git a/content/en/docs/v1.5/install/kubernetes/talosctl.md b/content/en/docs/v1.5/install/kubernetes/talosctl.md index 0acc569e..a89ee9f8 100644 --- a/content/en/docs/v1.5/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.5/install/kubernetes/talosctl.md @@ -85,6 +85,9 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the + # Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI). + grubUseUKICmdline: false extraKernelArgs: # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - kvm_intel.nested=0 From 3be81593035fc5d553398777c06e73c9e610d132 Mon Sep 17 00:00:00 2001 From: Andrei Kvapil Date: Tue, 7 Jul 2026 20:58:14 +0200 Subject: [PATCH 3/5] docs: drop nested-virt args from pre-1.12 install guides (CVE-2026-53359) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On Talos <1.12 machine.install.extraKernelArgs is a no-op on UEFI/UKI nodes and grubUseUKICmdline does not exist to opt out, so the snippet did nothing on modern hardware. Remove it from the v0-v1.2 guides (Talos v1.10.3); ≥1.12 guides keep the working grubUseUKICmdline=false + extraKernelArgs form. Signed-off-by: Andrei Kvapil Assisted-By: Claude --- content/en/docs/v0/install/kubernetes/talos-bootstrap.md | 4 ---- content/en/docs/v0/install/kubernetes/talosctl.md | 4 ---- content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md | 4 ---- content/en/docs/v1.0/install/kubernetes/talosctl.md | 4 ---- content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md | 4 ---- content/en/docs/v1.1/install/kubernetes/talosctl.md | 4 ---- content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md | 4 ---- content/en/docs/v1.2/install/kubernetes/talosctl.md | 4 ---- 8 files changed, 32 deletions(-) diff --git a/content/en/docs/v0/install/kubernetes/talos-bootstrap.md b/content/en/docs/v0/install/kubernetes/talos-bootstrap.md index aee4a4a8..267e61b4 100644 --- a/content/en/docs/v0/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v0/install/kubernetes/talos-bootstrap.md @@ -69,10 +69,6 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 - extraKernelArgs: - # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - - kvm_intel.nested=0 - - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v0/install/kubernetes/talosctl.md b/content/en/docs/v0/install/kubernetes/talosctl.md index 3d56452a..32a6dbf8 100644 --- a/content/en/docs/v0/install/kubernetes/talosctl.md +++ b/content/en/docs/v0/install/kubernetes/talosctl.md @@ -89,10 +89,6 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 - extraKernelArgs: - # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - - kvm_intel.nested=0 - - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md index 98fb2cb3..479fe9bc 100644 --- a/content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md @@ -65,10 +65,6 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 - extraKernelArgs: - # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - - kvm_intel.nested=0 - - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.0/install/kubernetes/talosctl.md b/content/en/docs/v1.0/install/kubernetes/talosctl.md index 18ef90b7..4675df1e 100644 --- a/content/en/docs/v1.0/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.0/install/kubernetes/talosctl.md @@ -85,10 +85,6 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 - extraKernelArgs: - # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - - kvm_intel.nested=0 - - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md index 945f60b3..b380163f 100644 --- a/content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md @@ -65,10 +65,6 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 - extraKernelArgs: - # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - - kvm_intel.nested=0 - - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.1/install/kubernetes/talosctl.md b/content/en/docs/v1.1/install/kubernetes/talosctl.md index 24633032..3cf1b41a 100644 --- a/content/en/docs/v1.1/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.1/install/kubernetes/talosctl.md @@ -85,10 +85,6 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 - extraKernelArgs: - # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - - kvm_intel.nested=0 - - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md index a7597117..19272544 100644 --- a/content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md @@ -65,10 +65,6 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 - extraKernelArgs: - # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - - kvm_intel.nested=0 - - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.2/install/kubernetes/talosctl.md b/content/en/docs/v1.2/install/kubernetes/talosctl.md index 439013f0..0f451543 100644 --- a/content/en/docs/v1.2/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.2/install/kubernetes/talosctl.md @@ -85,10 +85,6 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 - extraKernelArgs: - # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - - kvm_intel.nested=0 - - kvm_amd.nested=0 registries: mirrors: docker.io: From 1a3748a170beaa80509ba4aefec96018411f22e9 Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Wed, 8 Jul 2026 17:23:37 +0300 Subject: [PATCH 4/5] docs: point CVE-2026-53359 mitigation at the Talos image in current install guides MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The KVM nested-virtualization mitigation for CVE-2026-53359 ("Januscape") belongs in the Cozystack Talos image, not in every user's machine config. kvm_intel/kvm_amd are built into the kernel, so nested= is only settable on the kernel command line, and on UEFI/systemd-boot that command line is baked into the UKI — a machine-config extraKernelArgs override is silently ignored there. The image disables nested virtualization by default (baked into the boot assets at build time), which makes the config-side snippet both UEFI-ineffective and redundant. Drop the grubUseUKICmdline/extraKernelArgs snippet from the next, v1.3, v1.4 and v1.5 install guides and replace it with a note that the image disables nested virtualization by default, plus an honest pointer on re-enabling it (rebuild the image, since the setting lives in the boot assets). Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- .../docs/next/install/kubernetes/talos-bootstrap.md | 11 ++++------- content/en/docs/next/install/kubernetes/talosctl.md | 11 ++++------- .../docs/v1.3/install/kubernetes/talos-bootstrap.md | 11 ++++------- content/en/docs/v1.3/install/kubernetes/talosctl.md | 11 ++++------- .../docs/v1.4/install/kubernetes/talos-bootstrap.md | 11 ++++------- content/en/docs/v1.4/install/kubernetes/talosctl.md | 11 ++++------- .../docs/v1.5/install/kubernetes/talos-bootstrap.md | 11 ++++------- content/en/docs/v1.5/install/kubernetes/talosctl.md | 11 ++++------- 8 files changed, 32 insertions(+), 56 deletions(-) diff --git a/content/en/docs/next/install/kubernetes/talos-bootstrap.md b/content/en/docs/next/install/kubernetes/talos-bootstrap.md index cf6f8853..a7a40aa8 100644 --- a/content/en/docs/next/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/next/install/kubernetes/talos-bootstrap.md @@ -65,13 +65,6 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} - # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the - # Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI). - grubUseUKICmdline: false - extraKernelArgs: - # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - - kvm_intel.nested=0 - - kvm_amd.nested=0 registries: mirrors: docker.io: @@ -109,6 +102,10 @@ talos-bootstrap --help - 10.96.0.0/16 ``` + {{% alert title="KVM nested virtualization is disabled by default" color="warning" %}} + The Cozystack Talos image disables KVM nested virtualization (`kvm_intel.nested=0`, `kvm_amd.nested=0`) to mitigate [CVE-2026-53359](/blog/2026/07/security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/) ("Januscape"), a KVM guest-to-host escape. Cozystack VMs do not need nested virtualization, so no machine-config change is required. If a workload genuinely needs it, build a custom Talos image without these arguments — the setting is baked into the boot assets, so a `machine.install.extraKernelArgs` override is silently ignored on UEFI/systemd-boot nodes. + {{% /alert %}} + {{% alert title="Do not change op: on these entries" color="warning" %}} Talos rejects `op: create` for any file outside `/var`, returning the error `create operation not allowed outside of /var` — the only exception is the special-cased `/etc/cri/conf.d/20-customization.part`. Because `/etc/lvm/lvm.conf` already exists on the node, it must use `op: overwrite`. Changing the op (or pointing `create` at another `/etc` path) fails the `WriteUserFiles` boot step: the node pauses and enters a reboot loop, and `talosctl bootstrap` reports only `bootstrap is not available yet` with no obvious cause. {{% /alert %}} diff --git a/content/en/docs/next/install/kubernetes/talosctl.md b/content/en/docs/next/install/kubernetes/talosctl.md index f8c1f9ee..e2fdaff6 100644 --- a/content/en/docs/next/install/kubernetes/talosctl.md +++ b/content/en/docs/next/install/kubernetes/talosctl.md @@ -85,13 +85,6 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} - # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the - # Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI). - grubUseUKICmdline: false - extraKernelArgs: - # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - - kvm_intel.nested=0 - - kvm_amd.nested=0 registries: mirrors: docker.io: @@ -133,6 +126,10 @@ Discovered open port 50000/tcp on 192.168.123.13 - 10.96.0.0/16 ``` + {{% alert title="KVM nested virtualization is disabled by default" color="warning" %}} + The Cozystack Talos image disables KVM nested virtualization (`kvm_intel.nested=0`, `kvm_amd.nested=0`) to mitigate [CVE-2026-53359](/blog/2026/07/security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/) ("Januscape"), a KVM guest-to-host escape. Cozystack VMs do not need nested virtualization, so no machine-config change is required. If a workload genuinely needs it, build a custom Talos image without these arguments — the setting is baked into the boot assets, so a `machine.install.extraKernelArgs` override is silently ignored on UEFI/systemd-boot nodes. + {{% /alert %}} + {{% alert title="Do not change op: on these entries" color="warning" %}} Talos rejects `op: create` for any file outside `/var`, returning the error `create operation not allowed outside of /var` — the only exception is the special-cased `/etc/cri/conf.d/20-customization.part`. Because `/etc/lvm/lvm.conf` already exists on the node, it must use `op: overwrite`. Changing the op (or pointing `create` at another `/etc` path) fails the `WriteUserFiles` boot step: the node pauses and enters a reboot loop, and `talosctl bootstrap` reports only `bootstrap is not available yet` with no obvious cause. {{% /alert %}} diff --git a/content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md index e64e7280..ff145f43 100644 --- a/content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md @@ -65,13 +65,6 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} - # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the - # Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI). - grubUseUKICmdline: false - extraKernelArgs: - # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - - kvm_intel.nested=0 - - kvm_amd.nested=0 registries: mirrors: docker.io: @@ -109,6 +102,10 @@ talos-bootstrap --help - 10.96.0.0/16 ``` + {{% alert title="KVM nested virtualization is disabled by default" color="warning" %}} + The Cozystack Talos image disables KVM nested virtualization (`kvm_intel.nested=0`, `kvm_amd.nested=0`) to mitigate [CVE-2026-53359](/blog/2026/07/security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/) ("Januscape"), a KVM guest-to-host escape. Cozystack VMs do not need nested virtualization, so no machine-config change is required. If a workload genuinely needs it, build a custom Talos image without these arguments — the setting is baked into the boot assets, so a `machine.install.extraKernelArgs` override is silently ignored on UEFI/systemd-boot nodes. + {{% /alert %}} + 1. Make another configuration patch file `patch-controlplane.yaml` with settings exclusive to control plane nodes: ```yaml diff --git a/content/en/docs/v1.3/install/kubernetes/talosctl.md b/content/en/docs/v1.3/install/kubernetes/talosctl.md index 600254c4..77270a35 100644 --- a/content/en/docs/v1.3/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.3/install/kubernetes/talosctl.md @@ -85,13 +85,6 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} - # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the - # Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI). - grubUseUKICmdline: false - extraKernelArgs: - # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - - kvm_intel.nested=0 - - kvm_amd.nested=0 registries: mirrors: docker.io: @@ -133,6 +126,10 @@ Discovered open port 50000/tcp on 192.168.123.13 - 10.96.0.0/16 ``` + {{% alert title="KVM nested virtualization is disabled by default" color="warning" %}} + The Cozystack Talos image disables KVM nested virtualization (`kvm_intel.nested=0`, `kvm_amd.nested=0`) to mitigate [CVE-2026-53359](/blog/2026/07/security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/) ("Januscape"), a KVM guest-to-host escape. Cozystack VMs do not need nested virtualization, so no machine-config change is required. If a workload genuinely needs it, build a custom Talos image without these arguments — the setting is baked into the boot assets, so a `machine.install.extraKernelArgs` override is silently ignored on UEFI/systemd-boot nodes. + {{% /alert %}} + 1. Make another configuration patch file `patch-controlplane.yaml` with settings exclusive to control plane nodes: Note that VIP address is used for `machine.network.interfaces[0].vip.ip`: diff --git a/content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md index cfffa40b..321c701a 100644 --- a/content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md @@ -65,13 +65,6 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} - # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the - # Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI). - grubUseUKICmdline: false - extraKernelArgs: - # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - - kvm_intel.nested=0 - - kvm_amd.nested=0 registries: mirrors: docker.io: @@ -109,6 +102,10 @@ talos-bootstrap --help - 10.96.0.0/16 ``` + {{% alert title="KVM nested virtualization is disabled by default" color="warning" %}} + The Cozystack Talos image disables KVM nested virtualization (`kvm_intel.nested=0`, `kvm_amd.nested=0`) to mitigate [CVE-2026-53359](/blog/2026/07/security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/) ("Januscape"), a KVM guest-to-host escape. Cozystack VMs do not need nested virtualization, so no machine-config change is required. If a workload genuinely needs it, build a custom Talos image without these arguments — the setting is baked into the boot assets, so a `machine.install.extraKernelArgs` override is silently ignored on UEFI/systemd-boot nodes. + {{% /alert %}} + 1. Make another configuration patch file `patch-controlplane.yaml` with settings exclusive to control plane nodes: ```yaml diff --git a/content/en/docs/v1.4/install/kubernetes/talosctl.md b/content/en/docs/v1.4/install/kubernetes/talosctl.md index 7e2fc4cd..965ac502 100644 --- a/content/en/docs/v1.4/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.4/install/kubernetes/talosctl.md @@ -85,13 +85,6 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} - # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the - # Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI). - grubUseUKICmdline: false - extraKernelArgs: - # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - - kvm_intel.nested=0 - - kvm_amd.nested=0 registries: mirrors: docker.io: @@ -133,6 +126,10 @@ Discovered open port 50000/tcp on 192.168.123.13 - 10.96.0.0/16 ``` + {{% alert title="KVM nested virtualization is disabled by default" color="warning" %}} + The Cozystack Talos image disables KVM nested virtualization (`kvm_intel.nested=0`, `kvm_amd.nested=0`) to mitigate [CVE-2026-53359](/blog/2026/07/security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/) ("Januscape"), a KVM guest-to-host escape. Cozystack VMs do not need nested virtualization, so no machine-config change is required. If a workload genuinely needs it, build a custom Talos image without these arguments — the setting is baked into the boot assets, so a `machine.install.extraKernelArgs` override is silently ignored on UEFI/systemd-boot nodes. + {{% /alert %}} + 1. Make another configuration patch file `patch-controlplane.yaml` with settings exclusive to control plane nodes: Note that VIP address is used for `machine.network.interfaces[0].vip.ip`: diff --git a/content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md index 40d6db60..5b5a0737 100644 --- a/content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md @@ -65,13 +65,6 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} - # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the - # Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI). - grubUseUKICmdline: false - extraKernelArgs: - # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - - kvm_intel.nested=0 - - kvm_amd.nested=0 registries: mirrors: docker.io: @@ -109,6 +102,10 @@ talos-bootstrap --help - 10.96.0.0/16 ``` + {{% alert title="KVM nested virtualization is disabled by default" color="warning" %}} + The Cozystack Talos image disables KVM nested virtualization (`kvm_intel.nested=0`, `kvm_amd.nested=0`) to mitigate [CVE-2026-53359](/blog/2026/07/security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/) ("Januscape"), a KVM guest-to-host escape. Cozystack VMs do not need nested virtualization, so no machine-config change is required. If a workload genuinely needs it, build a custom Talos image without these arguments — the setting is baked into the boot assets, so a `machine.install.extraKernelArgs` override is silently ignored on UEFI/systemd-boot nodes. + {{% /alert %}} + 1. Make another configuration patch file `patch-controlplane.yaml` with settings exclusive to control plane nodes: ```yaml diff --git a/content/en/docs/v1.5/install/kubernetes/talosctl.md b/content/en/docs/v1.5/install/kubernetes/talosctl.md index a89ee9f8..1a7fb593 100644 --- a/content/en/docs/v1.5/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.5/install/kubernetes/talosctl.md @@ -85,13 +85,6 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} - # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the - # Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI). - grubUseUKICmdline: false - extraKernelArgs: - # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - - kvm_intel.nested=0 - - kvm_amd.nested=0 registries: mirrors: docker.io: @@ -133,6 +126,10 @@ Discovered open port 50000/tcp on 192.168.123.13 - 10.96.0.0/16 ``` + {{% alert title="KVM nested virtualization is disabled by default" color="warning" %}} + The Cozystack Talos image disables KVM nested virtualization (`kvm_intel.nested=0`, `kvm_amd.nested=0`) to mitigate [CVE-2026-53359](/blog/2026/07/security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/) ("Januscape"), a KVM guest-to-host escape. Cozystack VMs do not need nested virtualization, so no machine-config change is required. If a workload genuinely needs it, build a custom Talos image without these arguments — the setting is baked into the boot assets, so a `machine.install.extraKernelArgs` override is silently ignored on UEFI/systemd-boot nodes. + {{% /alert %}} + 1. Make another configuration patch file `patch-controlplane.yaml` with settings exclusive to control plane nodes: Note that VIP address is used for `machine.network.interfaces[0].vip.ip`: From c589dd857601ceb6bac23856eb9158ee9131006a Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Wed, 8 Jul 2026 17:25:42 +0300 Subject: [PATCH 5/5] docs: flag CVE-2026-53359 nested-virt exposure in pre-1.12 install guides The v0, v1.0, v1.1 and v1.2 install guides pin an older Cozystack Talos image (v1.10.3) that predates the CVE-2026-53359 ("Januscape") nested- virtualization mitigation and does not disable it. These Talos releases have no grubUseUKICmdline field, and machine.install.extraKernelArgs is a no-op on UEFI/systemd-boot (the command line is baked into the UKI), so an inline config snippet would silently fail on modern hardware. Add an honest note to each guide: the config-side override works only on BIOS/GRUB nodes, and for a reliable fix readers should follow the security advisory or upgrade to a current release whose Talos image disables nested virtualization by default. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- content/en/docs/v0/install/kubernetes/talos-bootstrap.md | 4 ++++ content/en/docs/v0/install/kubernetes/talosctl.md | 4 ++++ content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md | 4 ++++ content/en/docs/v1.0/install/kubernetes/talosctl.md | 4 ++++ content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md | 4 ++++ content/en/docs/v1.1/install/kubernetes/talosctl.md | 4 ++++ content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md | 4 ++++ content/en/docs/v1.2/install/kubernetes/talosctl.md | 4 ++++ 8 files changed, 32 insertions(+) diff --git a/content/en/docs/v0/install/kubernetes/talos-bootstrap.md b/content/en/docs/v0/install/kubernetes/talos-bootstrap.md index 267e61b4..a11b654c 100644 --- a/content/en/docs/v0/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v0/install/kubernetes/talos-bootstrap.md @@ -106,6 +106,10 @@ talos-bootstrap --help - 10.96.0.0/16 ``` + {{% alert title="KVM nested virtualization is not disabled in this image" color="warning" %}} + The Talos image pinned above predates the KVM nested-virtualization mitigation for [CVE-2026-53359](/blog/2026/07/security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/) ("Januscape"), a KVM guest-to-host escape. Adding `kvm_intel.nested=0` / `kvm_amd.nested=0` to `machine.install.extraKernelArgs` takes effect only on BIOS/GRUB nodes; on UEFI/systemd-boot the kernel command line is baked into the UKI and the override is silently ignored. To mitigate reliably, follow the linked advisory or upgrade to a current Cozystack release whose Talos image disables nested virtualization by default. + {{% /alert %}} + 1. Make another configuration patch file `patch-controlplane.yaml` with settings exclusive to control plane nodes: ```yaml diff --git a/content/en/docs/v0/install/kubernetes/talosctl.md b/content/en/docs/v0/install/kubernetes/talosctl.md index 32a6dbf8..66618af8 100644 --- a/content/en/docs/v0/install/kubernetes/talosctl.md +++ b/content/en/docs/v0/install/kubernetes/talosctl.md @@ -130,6 +130,10 @@ Discovered open port 50000/tcp on 192.168.123.13 - 10.96.0.0/16 ``` + {{% alert title="KVM nested virtualization is not disabled in this image" color="warning" %}} + The Talos image pinned above predates the KVM nested-virtualization mitigation for [CVE-2026-53359](/blog/2026/07/security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/) ("Januscape"), a KVM guest-to-host escape. Adding `kvm_intel.nested=0` / `kvm_amd.nested=0` to `machine.install.extraKernelArgs` takes effect only on BIOS/GRUB nodes; on UEFI/systemd-boot the kernel command line is baked into the UKI and the override is silently ignored. To mitigate reliably, follow the linked advisory or upgrade to a current Cozystack release whose Talos image disables nested virtualization by default. + {{% /alert %}} + 1. Make another configuration patch file `patch-controlplane.yaml` with settings exclusive to control plane nodes: Note that VIP address is used for `machine.network.interfaces[0].vip.ip`: diff --git a/content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md index 479fe9bc..3a76627f 100644 --- a/content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md @@ -102,6 +102,10 @@ talos-bootstrap --help - 10.96.0.0/16 ``` + {{% alert title="KVM nested virtualization is not disabled in this image" color="warning" %}} + The Talos image pinned above predates the KVM nested-virtualization mitigation for [CVE-2026-53359](/blog/2026/07/security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/) ("Januscape"), a KVM guest-to-host escape. Adding `kvm_intel.nested=0` / `kvm_amd.nested=0` to `machine.install.extraKernelArgs` takes effect only on BIOS/GRUB nodes; on UEFI/systemd-boot the kernel command line is baked into the UKI and the override is silently ignored. To mitigate reliably, follow the linked advisory or upgrade to a current Cozystack release whose Talos image disables nested virtualization by default. + {{% /alert %}} + 1. Make another configuration patch file `patch-controlplane.yaml` with settings exclusive to control plane nodes: ```yaml diff --git a/content/en/docs/v1.0/install/kubernetes/talosctl.md b/content/en/docs/v1.0/install/kubernetes/talosctl.md index 4675df1e..6171f662 100644 --- a/content/en/docs/v1.0/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.0/install/kubernetes/talosctl.md @@ -126,6 +126,10 @@ Discovered open port 50000/tcp on 192.168.123.13 - 10.96.0.0/16 ``` + {{% alert title="KVM nested virtualization is not disabled in this image" color="warning" %}} + The Talos image pinned above predates the KVM nested-virtualization mitigation for [CVE-2026-53359](/blog/2026/07/security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/) ("Januscape"), a KVM guest-to-host escape. Adding `kvm_intel.nested=0` / `kvm_amd.nested=0` to `machine.install.extraKernelArgs` takes effect only on BIOS/GRUB nodes; on UEFI/systemd-boot the kernel command line is baked into the UKI and the override is silently ignored. To mitigate reliably, follow the linked advisory or upgrade to a current Cozystack release whose Talos image disables nested virtualization by default. + {{% /alert %}} + 1. Make another configuration patch file `patch-controlplane.yaml` with settings exclusive to control plane nodes: Note that VIP address is used for `machine.network.interfaces[0].vip.ip`: diff --git a/content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md index b380163f..db310a88 100644 --- a/content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md @@ -102,6 +102,10 @@ talos-bootstrap --help - 10.96.0.0/16 ``` + {{% alert title="KVM nested virtualization is not disabled in this image" color="warning" %}} + The Talos image pinned above predates the KVM nested-virtualization mitigation for [CVE-2026-53359](/blog/2026/07/security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/) ("Januscape"), a KVM guest-to-host escape. Adding `kvm_intel.nested=0` / `kvm_amd.nested=0` to `machine.install.extraKernelArgs` takes effect only on BIOS/GRUB nodes; on UEFI/systemd-boot the kernel command line is baked into the UKI and the override is silently ignored. To mitigate reliably, follow the linked advisory or upgrade to a current Cozystack release whose Talos image disables nested virtualization by default. + {{% /alert %}} + 1. Make another configuration patch file `patch-controlplane.yaml` with settings exclusive to control plane nodes: ```yaml diff --git a/content/en/docs/v1.1/install/kubernetes/talosctl.md b/content/en/docs/v1.1/install/kubernetes/talosctl.md index 3cf1b41a..4c0f4ef8 100644 --- a/content/en/docs/v1.1/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.1/install/kubernetes/talosctl.md @@ -126,6 +126,10 @@ Discovered open port 50000/tcp on 192.168.123.13 - 10.96.0.0/16 ``` + {{% alert title="KVM nested virtualization is not disabled in this image" color="warning" %}} + The Talos image pinned above predates the KVM nested-virtualization mitigation for [CVE-2026-53359](/blog/2026/07/security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/) ("Januscape"), a KVM guest-to-host escape. Adding `kvm_intel.nested=0` / `kvm_amd.nested=0` to `machine.install.extraKernelArgs` takes effect only on BIOS/GRUB nodes; on UEFI/systemd-boot the kernel command line is baked into the UKI and the override is silently ignored. To mitigate reliably, follow the linked advisory or upgrade to a current Cozystack release whose Talos image disables nested virtualization by default. + {{% /alert %}} + 1. Make another configuration patch file `patch-controlplane.yaml` with settings exclusive to control plane nodes: Note that VIP address is used for `machine.network.interfaces[0].vip.ip`: diff --git a/content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md index 19272544..68742cab 100644 --- a/content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md @@ -102,6 +102,10 @@ talos-bootstrap --help - 10.96.0.0/16 ``` + {{% alert title="KVM nested virtualization is not disabled in this image" color="warning" %}} + The Talos image pinned above predates the KVM nested-virtualization mitigation for [CVE-2026-53359](/blog/2026/07/security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/) ("Januscape"), a KVM guest-to-host escape. Adding `kvm_intel.nested=0` / `kvm_amd.nested=0` to `machine.install.extraKernelArgs` takes effect only on BIOS/GRUB nodes; on UEFI/systemd-boot the kernel command line is baked into the UKI and the override is silently ignored. To mitigate reliably, follow the linked advisory or upgrade to a current Cozystack release whose Talos image disables nested virtualization by default. + {{% /alert %}} + 1. Make another configuration patch file `patch-controlplane.yaml` with settings exclusive to control plane nodes: ```yaml diff --git a/content/en/docs/v1.2/install/kubernetes/talosctl.md b/content/en/docs/v1.2/install/kubernetes/talosctl.md index 0f451543..05207761 100644 --- a/content/en/docs/v1.2/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.2/install/kubernetes/talosctl.md @@ -126,6 +126,10 @@ Discovered open port 50000/tcp on 192.168.123.13 - 10.96.0.0/16 ``` + {{% alert title="KVM nested virtualization is not disabled in this image" color="warning" %}} + The Talos image pinned above predates the KVM nested-virtualization mitigation for [CVE-2026-53359](/blog/2026/07/security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/) ("Januscape"), a KVM guest-to-host escape. Adding `kvm_intel.nested=0` / `kvm_amd.nested=0` to `machine.install.extraKernelArgs` takes effect only on BIOS/GRUB nodes; on UEFI/systemd-boot the kernel command line is baked into the UKI and the override is silently ignored. To mitigate reliably, follow the linked advisory or upgrade to a current Cozystack release whose Talos image disables nested virtualization by default. + {{% /alert %}} + 1. Make another configuration patch file `patch-controlplane.yaml` with settings exclusive to control plane nodes: Note that VIP address is used for `machine.network.interfaces[0].vip.ip`: