Skip to content

feat(cozystack): disable KVM nested virtualization in Talos skills (CVE-2026-53359) #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Andrei Kvapil (kvaps) wants to merge 2 commits into
base: main
Choose a base branch
from
+24 −0
Open

feat(cozystack): disable KVM nested virtualization in Talos skills (CVE-2026-53359) #17

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e905157
feat(cozystack): disable KVM nested virtualization in Talos skills (C…
kvaps Jul 7, 2026
3b4c8b8
fix(cozystack): pin grubUseUKICmdline=false and note upgrade-only rol…
kvaps Jul 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions plugins/cozystack/skills/cluster-upgrade/references/post-upgrade-checks.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,10 @@ kubectl --context $CTX get tenantcontrolplane -A
alias linstor='kubectl exec -n cozy-linstor deploy/linstor-controller -ti -- linstor'
linstor node list
linstor resource list --faulty

# 6. CVE-2026-53359 mitigation survived the OS upgrade (nested virtualization still off).
# machine.install.extraKernelArgs is re-applied by `talm upgrade`; confirm per node:
talm -n <node-ip> read /proc/cmdline | grep -o 'kvm_intel.nested=[01]' # expect kvm_intel.nested=0

@gemini-code-assist gemini-code-assist Bot Jul 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The command uses talm to read /proc/cmdline, but talm does not have a read command. Direct node file reading is performed using talosctl.

Suggested change
talm -n <node-ip> read /proc/cmdline | grep -o 'kvm_intel.nested=[01]' # expect kvm_intel.nested=0
talosctl -n <node-ip> read /proc/cmdline | grep -o 'kvm_intel.nested=[01]' # expect kvm_intel.nested=0

```

## Targeted checks (map from change-risk summary)
Expand Down
13 changes: 13 additions & 0 deletions plugins/cozystack/skills/talos-bootstrap/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,18 @@ for node_idx in "${!INVENTORY_NODE_NAMES[@]}"; do
cat > "$f" <<EOF
# talos-version: $TALOS_VERSION
# talm-template: ../templates
machine:
install:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation).
# kvm_intel/kvm_amd are built into the Talos kernel, so nested= is settable
# only from the kernel command line. On Talos >=1.12 pin grubUseUKICmdline
# false so the args land on the Talos-built cmdline (Talos rejects/ignores
# extraKernelArgs under the UKI cmdline). Applied by the installer, so it
# takes effect on "talm upgrade", not a plain "talm apply".
grubUseUKICmdline: false
extraKernelArgs:
- kvm_intel.nested=0
- kvm_amd.nested=0
---
apiVersion: v1alpha1
kind: HostnameConfig
Expand Down Expand Up @@ -402,6 +414,7 @@ If `state.cluster.vip.per_node[$node]` exists but the LinkConfig doc is missing,
Present each `nodes/<name>.yaml` for review. Things to spot before apply:

- `machine.install.image` should be `ghcr.io/cozystack/cozystack/talos:<tag>`. The cozystack preset sets this; surface if missing.
- `machine.install.extraKernelArgs` should include `kvm_intel.nested=0` and `kvm_amd.nested=0` — the CVE-2026-53359 (Januscape) nested-virtualization guest-to-host escape mitigation. The Phase 6.5 overlay and the cozystack preset set these; surface if missing (e.g. an older preset).
- `machine.kernel.modules` should list drbd / zfs / spl / openvswitch / vfio_pci / vfio_iommu_type1.
- For CP nodes: `machine.type: controlplane`, optional `machine.network.interfaces[].vip` for HA.
- `machine.install.disk` defaults to a heuristic — confirm it picks the right system disk on multi-disk nodes (operator can edit nodes/<name>.yaml before apply).
Expand Down
7 changes: 7 additions & 0 deletions plugins/cozystack/skills/talos-bootstrap/references/manual-steps.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,6 +131,13 @@ machine:
# Required: which interface to install Talos to.
install:
disk: /dev/sda
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation).
# On Talos >=1.12 pin grubUseUKICmdline false so the args land on the built
# cmdline. Takes effect on `talm upgrade` (installer re-run), not `talm apply`.
grubUseUKICmdline: false
extraKernelArgs:
- kvm_intel.nested=0
- kvm_amd.nested=0
---
apiVersion: v1alpha1
kind: HostnameConfig
Expand Down
Loading