Skip to content

docs: disable KVM nested virtualization in Talos install configs (CVE-2026-53359) #602

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Andrei Kvapil (kvaps) wants to merge 3 commits into
base: main
Choose a base branch
from
Open

docs: disable KVM nested virtualization in Talos install configs (CVE-2026-53359) #602

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4643a41
docs: disable KVM nested virtualization in Talos install configs (CVE…
kvaps Jul 7, 2026
642dbb2
docs: pin grubUseUKICmdline=false for Talos >=1.12 so kvm nested args…
kvaps Jul 7, 2026
a593dc6
docs: drop nested-virt args from pre-1.12 install guides (CVE-2026-53…
kvaps Jul 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions content/en/docs/next/install/kubernetes/talos-bootstrap.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,13 @@ talos-bootstrap --help
- name: vfio_iommu_type1
install:
image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}}
# On Talos >=1.12 pin grubUseUKICmdline false so the args land on the
# Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI).
grubUseUKICmdline: false
extraKernelArgs:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
- kvm_intel.nested=0
- kvm_amd.nested=0
Comment on lines +71 to +74

@gemini-code-assist gemini-code-assist Bot Jul 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-medium medium

Starting with Talos 1.10, fresh installations on UEFI systems use systemd-boot and Unified Kernel Images (UKIs). On these systems, the .machine.install.extraKernelArgs field in the machine configuration is completely ignored because kernel arguments are embedded directly within the UKI.

Since all documentation versions from v0 (using Talos v1.10.3) to next (using Talos v1.13.0) target Talos 1.10+, this mitigation will be silently ignored on any UEFI-booted nodes, leaving them vulnerable to CVE-2026-53359.

To ensure users are actually protected, please add a warning note in the documentation explaining that on UEFI-booted systems, these kernel arguments must be baked into the boot assets using the Image Factory or Imager (via customization schematics) instead of relying on extraKernelArgs in the machine configuration.

Suggested change
extraKernelArgs:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
- kvm_intel.nested=0
- kvm_amd.nested=0
extraKernelArgs:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
# Note: This is ignored on UEFI systems using Talos 1.10+ (use Image Factory instead)
- kvm_intel.nested=0
- kvm_amd.nested=0

registries:
mirrors:
docker.io:
Expand Down
7 changes: 7 additions & 0 deletions content/en/docs/next/install/kubernetes/talosctl.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,13 @@ Discovered open port 50000/tcp on 192.168.123.13
- name: vfio_iommu_type1
install:
image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}}
# On Talos >=1.12 pin grubUseUKICmdline false so the args land on the
# Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI).
grubUseUKICmdline: false
extraKernelArgs:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
- kvm_intel.nested=0
- kvm_amd.nested=0
Comment on lines +88 to +94

@coderabbitai coderabbitai Bot Jul 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Indent the extraKernelArgs list under its key.

The list items are rendered at the same indentation level as extraKernelArgs:, so this patch example is not valid YAML as written. Please nest the comment and both kernel args one level deeper.

Fix 
         grubUseUKICmdline: false
         extraKernelArgs:
-        # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
-        - kvm_intel.nested=0
-        - kvm_amd.nested=0
+          # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
+          - kvm_intel.nested=0
+          - kvm_amd.nested=0
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# On Talos >=1.12 pin grubUseUKICmdline false so the args land on the
# Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI).
grubUseUKICmdline: false
extraKernelArgs:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
- kvm_intel.nested=0
- kvm_amd.nested=0
# On Talos >=1.12 pin grubUseUKICmdline false so the args land on the
# Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI).
grubUseUKICmdline: false
extraKernelArgs:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
- kvm_intel.nested=0
- kvm_amd.nested=0
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@content/en/docs/next/install/kubernetes/talosctl.md` around lines 88 - 94,
The Talos patch example has an invalid YAML structure because the
extraKernelArgs list is not nested under its key. Update the example in the
talosctl docs so extraKernelArgs and its commented kernel args are indented one
level deeper beneath grubUseUKICmdline, keeping the list items aligned under
extraKernelArgs for valid YAML.

registries:
mirrors:
docker.io:
Expand Down
7 changes: 7 additions & 0 deletions content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,13 @@ talos-bootstrap --help
- name: vfio_iommu_type1
install:
image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}}
# On Talos >=1.12 pin grubUseUKICmdline false so the args land on the
# Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI).
grubUseUKICmdline: false
extraKernelArgs:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
- kvm_intel.nested=0
- kvm_amd.nested=0
Comment on lines +68 to +74

@coderabbitai coderabbitai Bot Jul 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Indent the extraKernelArgs list under its key.

This block reads as if the sequence items are at the same level as extraKernelArgs:, which breaks the YAML example. Please indent the comment and both - kvm_* entries one level deeper.

Fix 
         grubUseUKICmdline: false
         extraKernelArgs:
-        # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
-        - kvm_intel.nested=0
-        - kvm_amd.nested=0
+          # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
+          - kvm_intel.nested=0
+          - kvm_amd.nested=0
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# On Talos >=1.12 pin grubUseUKICmdline false so the args land on the
# Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI).
grubUseUKICmdline: false
extraKernelArgs:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
- kvm_intel.nested=0
- kvm_amd.nested=0
# On Talos >=1.12 pin grubUseUKICmdline false so the args land on the
# Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI).
grubUseUKICmdline: false
extraKernelArgs:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
- kvm_intel.nested=0
- kvm_amd.nested=0
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md` around lines 68 -
74, The Talos bootstrap YAML example has the extraKernelArgs list at the wrong
indentation level, so the sequence items are not nested under the key. Update
the talos-bootstrap.md example so extraKernelArgs: is followed by an indented
comment and both kvm_intel.nested=0 and kvm_amd.nested=0 entries one level
deeper, keeping the block aligned with the surrounding YAML structure.

registries:
mirrors:
docker.io:
Expand Down
7 changes: 7 additions & 0 deletions content/en/docs/v1.3/install/kubernetes/talosctl.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,13 @@ Discovered open port 50000/tcp on 192.168.123.13
- name: vfio_iommu_type1
install:
image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}}
# On Talos >=1.12 pin grubUseUKICmdline false so the args land on the
# Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI).
grubUseUKICmdline: false
extraKernelArgs:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
- kvm_intel.nested=0
- kvm_amd.nested=0
Comment on lines +88 to +94

@coderabbitai coderabbitai Bot Jul 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Indent the extraKernelArgs list under its key.

As written, the list items sit alongside extraKernelArgs: instead of nesting under it, so the example is not valid YAML. Please push the comment and both kernel args one level deeper.

Fix 
         grubUseUKICmdline: false
         extraKernelArgs:
-        # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
-        - kvm_intel.nested=0
-        - kvm_amd.nested=0
+          # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
+          - kvm_intel.nested=0
+          - kvm_amd.nested=0
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# On Talos >=1.12 pin grubUseUKICmdline false so the args land on the
# Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI).
grubUseUKICmdline: false
extraKernelArgs:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
- kvm_intel.nested=0
- kvm_amd.nested=0
# On Talos >=1.12 pin grubUseUKICmdline false so the args land on the
# Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI).
grubUseUKICmdline: false
extraKernelArgs:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
- kvm_intel.nested=0
- kvm_amd.nested=0
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@content/en/docs/v1.3/install/kubernetes/talosctl.md` around lines 88 - 94,
The Talos install example has invalid YAML because the extraKernelArgs list is
not nested under its key. Update the talosctl markdown snippet so the comments
and both kernel argument entries are indented one level deeper under
extraKernelArgs, keeping grubUseUKICmdline in the same block and preserving the
example’s structure.

registries:
mirrors:
docker.io:
Expand Down
7 changes: 7 additions & 0 deletions content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,13 @@ talos-bootstrap --help
- name: vfio_iommu_type1
install:
image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}}
# On Talos >=1.12 pin grubUseUKICmdline false so the args land on the
# Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI).
grubUseUKICmdline: false
extraKernelArgs:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
- kvm_intel.nested=0
- kvm_amd.nested=0
Comment on lines +68 to +74

@coderabbitai coderabbitai Bot Jul 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Indent the extraKernelArgs list under its key.

The current indentation makes the list items look sibling-level to extraKernelArgs:, which breaks the YAML example. Please indent the comment and both - kvm_* entries one level deeper.

Fix 
         grubUseUKICmdline: false
         extraKernelArgs:
-        # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
-        - kvm_intel.nested=0
-        - kvm_amd.nested=0
+          # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
+          - kvm_intel.nested=0
+          - kvm_amd.nested=0
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# On Talos >=1.12 pin grubUseUKICmdline false so the args land on the
# Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI).
grubUseUKICmdline: false
extraKernelArgs:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
- kvm_intel.nested=0
- kvm_amd.nested=0
# On Talos >=1.12 pin grubUseUKICmdline false so the args land on the
# Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI).
grubUseUKICmdline: false
extraKernelArgs:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
- kvm_intel.nested=0
- kvm_amd.nested=0
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md` around lines 68 -
74, The Talos bootstrap YAML example has a malformed `extraKernelArgs` block
because the comment and both `kvm_intel.nested=0` / `kvm_amd.nested=0` entries
are not indented under `extraKernelArgs:`. Update the `talos-bootstrap.md`
snippet so the `extraKernelArgs` key in the bootstrap example contains an
indented list, keeping the comment and both list items nested beneath it.

registries:
mirrors:
docker.io:
Expand Down
7 changes: 7 additions & 0 deletions content/en/docs/v1.4/install/kubernetes/talosctl.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,13 @@ Discovered open port 50000/tcp on 192.168.123.13
- name: vfio_iommu_type1
install:
image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}}
# On Talos >=1.12 pin grubUseUKICmdline false so the args land on the
# Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI).
grubUseUKICmdline: false
extraKernelArgs:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
- kvm_intel.nested=0
- kvm_amd.nested=0
Comment on lines +88 to +94

@coderabbitai coderabbitai Bot Jul 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Indent the extraKernelArgs list under its key.

The example needs the sequence items nested under extraKernelArgs:; otherwise it is invalid YAML for readers copying it into a patch file. Please indent the comment and both kernel args one level deeper.

Fix 
         grubUseUKICmdline: false
         extraKernelArgs:
-        # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
-        - kvm_intel.nested=0
-        - kvm_amd.nested=0
+          # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
+          - kvm_intel.nested=0
+          - kvm_amd.nested=0
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# On Talos >=1.12 pin grubUseUKICmdline false so the args land on the
# Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI).
grubUseUKICmdline: false
extraKernelArgs:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
- kvm_intel.nested=0
- kvm_amd.nested=0
grubUseUKICmdline: false
extraKernelArgs:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
- kvm_intel.nested=0
- kvm_amd.nested=0
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@content/en/docs/v1.4/install/kubernetes/talosctl.md` around lines 88 - 94,
The Talos install example has an invalid YAML structure because the
extraKernelArgs sequence items are not nested under the extraKernelArgs key.
Update the example in the talosctl install section so the comment and both
kernel args are indented one level deeper under extraKernelArgs, keeping the
surrounding grubUseUKICmdline setting unchanged.

registries:
mirrors:
docker.io:
Expand Down
7 changes: 7 additions & 0 deletions content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,13 @@ talos-bootstrap --help
- name: vfio_iommu_type1
install:
image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}}
# On Talos >=1.12 pin grubUseUKICmdline false so the args land on the
# Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI).
grubUseUKICmdline: false
extraKernelArgs:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
- kvm_intel.nested=0
- kvm_amd.nested=0
Comment on lines +68 to +74

@coderabbitai coderabbitai Bot Jul 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Indent the extraKernelArgs list under its key.

As rendered here, the sequence items are not nested under extraKernelArgs:, so the example will not parse as YAML. Please indent the comment and both - kvm_* entries one level deeper.

Fix 
         grubUseUKICmdline: false
         extraKernelArgs:
-        # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
-        - kvm_intel.nested=0
-        - kvm_amd.nested=0
+          # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
+          - kvm_intel.nested=0
+          - kvm_amd.nested=0
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# On Talos >=1.12 pin grubUseUKICmdline false so the args land on the
# Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI).
grubUseUKICmdline: false
extraKernelArgs:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
- kvm_intel.nested=0
- kvm_amd.nested=0
grubUseUKICmdline: false
extraKernelArgs:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
- kvm_intel.nested=0
- kvm_amd.nested=0
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md` around lines 68 -
74, The Talos bootstrap example has an invalid YAML structure because the
`extraKernelArgs` sequence items are not nested under the `extraKernelArgs` key.
Update the `talos-bootstrap.md` example so the comment and both
`kvm_intel.nested=0` and `kvm_amd.nested=0` entries are indented one level under
`extraKernelArgs`, keeping the surrounding `grubUseUKICmdline` block in
`talos-bootstrap` unchanged.

registries:
mirrors:
docker.io:
Expand Down
7 changes: 7 additions & 0 deletions content/en/docs/v1.5/install/kubernetes/talosctl.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,13 @@ Discovered open port 50000/tcp on 192.168.123.13
- name: vfio_iommu_type1
install:
image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}}
# On Talos >=1.12 pin grubUseUKICmdline false so the args land on the
# Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI).
grubUseUKICmdline: false
extraKernelArgs:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
- kvm_intel.nested=0
- kvm_amd.nested=0
Comment on lines +88 to +94

@coderabbitai coderabbitai Bot Jul 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Indent the extraKernelArgs list under its key.

The sequence items need to be nested under extraKernelArgs:; otherwise the patch example is invalid YAML. Please indent the comment and both kernel args one level deeper.

Fix 
         grubUseUKICmdline: false
         extraKernelArgs:
-        # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
-        - kvm_intel.nested=0
-        - kvm_amd.nested=0
+          # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
+          - kvm_intel.nested=0
+          - kvm_amd.nested=0
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# On Talos >=1.12 pin grubUseUKICmdline false so the args land on the
# Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI).
grubUseUKICmdline: false
extraKernelArgs:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
- kvm_intel.nested=0
- kvm_amd.nested=0
# On Talos >=1.12 pin grubUseUKICmdline false so the args land on the
# Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI).
grubUseUKICmdline: false
extraKernelArgs:
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
- kvm_intel.nested=0
- kvm_amd.nested=0
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@content/en/docs/v1.5/install/kubernetes/talosctl.md` around lines 88 - 94,
The YAML example in talosctl.md has the extraKernelArgs list at the wrong
indentation level, making the patch invalid. Update the Talos config snippet so
the extraKernelArgs key in the affected block has its comment and both kernel
arguments nested one level deeper under it, keeping the surrounding
grubUseUKICmdline example unchanged.

registries:
mirrors:
docker.io:
Expand Down