test(e2e): disable KVM nested virtualization (CVE-2026-53359) by kvaps · Pull Request #3234 · cozystack/cozystack

Andrei Kvapil (kvaps) · 2026-07-07T14:13:53Z

What this PR does

Disables KVM nested virtualization in the E2E Talos machine-config patch to mitigate CVE-2026-53359 ("Januscape"), a guest-to-host escape in the Linux KVM/x86 shadow MMU (a use-after-free in kvm_mmu_get_child_sp() caused by shadow-page role confusion).

The vulnerable code path is only reachable when a guest is allowed to use nested virtualization (i.e. the guest is given the vmx/svm CPU feature and runs its own nested guest). Setting kvm_intel.nested=0 and kvm_amd.nested=0 on the host removes the attack surface entirely, independent of the node kernel patch level.

The bug was fixed upstream in commit 81ccda30b4e8 and in stable kernels 6.12.95 / 6.6.144 / 6.1.177 / 6.18.38 / 7.1.3 (2026-07-04); as of this PR no released Talos ships a fixed kernel yet, so disabling nested virtualization is the reliable mitigation. Both args are set so a single config works on Intel and AMD hosts — the non-matching one is silently ignored.

Part of a coordinated set of PRs (see Related PRs below).

Release note

test(e2e): disable KVM nested virtualization to mitigate CVE-2026-53359 (Januscape guest-to-host escape)

Related PRs

Coordinated CVE-2026-53359 (Januscape) nested-virtualization mitigation across Cozystack repos:

test(e2e): disable KVM nested virtualization (CVE-2026-53359) #3234 — E2E Talos machine-config
fix(charts): disable KVM nested virtualization in Talos presets (CVE-2026-53359) talm#224 — Talos cozystack/generic presets (canonical source)
docs: point CVE-2026-53359 at the Talos v1.13.6 kernel fix website#602 — install docs (all versions)
feat(cozystack): disable KVM nested virtualization in Talos skills (CVE-2026-53359) ccp#17 — Talos bootstrap/upgrade skills (prescribe + verify, survives upgrades)
fix(prepare): disable KVM nested virtualization (CVE-2026-53359) ansible-cozystack#60 — generic Ubuntu/RHEL/SUSE hosts (modprobe.d)

Summary by CodeRabbit

Bug Fixes
- Updated cluster preparation defaults to disable nested virtualization on both Intel and AMD systems, improving boot-time consistency.
Security
- Updated boot-time configuration to apply new kernel command-line parameters related to virtualization behavior.
- Adjusted UKI command-line handling during cluster setup to align with the hardened configuration.

coderabbitai · 2026-07-07T14:14:03Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 40e3b7e6-6f4a-4cd5-abc0-ba3fc6dfb469

📥 Commits

Reviewing files that changed from the base of the PR and between 40e0a6f and c440a7c.

📒 Files selected for processing (1)

hack/e2e-prepare-cluster.bats

🚧 Files skipped from review as they are similar to previous changes (1)

hack/e2e-prepare-cluster.bats

📝 Walkthrough

Walkthrough

Updates the generated Talos patch YAML in the e2e cluster preparation script to disable UKI cmdline usage and add kernel arguments that turn off nested KVM on Intel and AMD.

Changes

Talos Patch Kernel Args Update

Layer / File(s)	Summary
Set Talos install kernel args `hack/e2e-prepare-cluster.bats`	Sets `machine.install.grubUseUKICmdline` to `false` and adds `kvm_intel.nested=0` and `kvm_amd.nested=0` to the generated `patch.yaml`, with a CVE comment.

Estimated code review effort: 1 (Trivial) | ~3 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: disabling KVM nested virtualization in e2e tests for CVE-2026-53359.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch security/cve-2026-53359-disable-nested-virt

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

gemini-code-assist · 2026-07-07T14:26:21Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request updates the E2E cluster preparation configuration to address a critical security vulnerability. By disabling nested virtualization at the kernel level, the changes prevent potential guest-to-host escapes while waiting for upstream kernel patches to be integrated into the Talos release cycle.

Highlights

Security Mitigation: Disabled KVM nested virtualization in the E2E Talos machine configuration to mitigate the CVE-2026-53359 (Januscape) guest-to-host escape vulnerability.
Kernel Configuration: Added kvm_intel.nested=0 and kvm_amd.nested=0 to the extra kernel arguments to ensure the attack surface is removed across both Intel and AMD platforms.

New Features

🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	Gemini (@gemini-code-assist)	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request updates the end-to-end cluster preparation configuration in hack/e2e-prepare-cluster.bats to disable KVM nested virtualization (kvm_intel.nested=0 and kvm_amd.nested=0) as a mitigation for CVE-2026-53359. There are no review comments, and I have no additional feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

IvanHunters

LGTM. The machine.install patch lands cluster-wide via --config-patch=@patch.yaml, and grubUseUKICmdline: false is correct and necessary for the pinned talosctl v1.13.5 (which defaults it true). No e2e regression.

Set kvm_intel.nested=0 and kvm_amd.nested=0 in the e2e Talos machine-config patch to mitigate CVE-2026-53359 (Januscape), a KVM guest-to-host escape reachable only when nested virtualization is exposed to the guest. Both args are set so one config covers Intel and AMD hosts. Signed-off-by: Andrei Kvapil <andrei.kvapil@aenix.io> Assisted-By: Claude <noreply@anthropic.com>

…os >=1.12 (CVE-2026-53359) On Talos >1.11 the base defaults machine.install.grubUseUKICmdline=true (UKI cmdline), which Talos rejects together with extraKernelArgs and which ignores them anyway. Pin it false so the nested=0 args land on the Talos-built cmdline. Signed-off-by: Andrei Kvapil <andrei.kvapil@aenix.io> Assisted-By: Claude <noreply@anthropic.com>

Aleksei Sviridkin (lexfrei) · 2026-07-09T12:42:27Z

Closing: superseded by #3240.

The change here disables KVM nested virtualization on the sandbox nodes and pins grubUseUKICmdline: false so the kernel args can be delivered. Both CVE-2026-53359 and its companion CVE-2026-46113 are fixed upstream in Linux 6.18.38, and #3240 moves the platform Talos profiles to v1.13.6, which ships that kernel. Fixing the bugs in the kernel keeps nested virtualization available for workloads that need it and leaves the boot path untouched, so there is nothing left for this change to protect against.

github-actions Bot added size/XS This PR changes 0-9 lines, ignoring generated files area/testing Issues or PRs related to testing (e2e, bats, unit tests) labels Jul 7, 2026

Andrei Kvapil (kvaps) marked this pull request as ready for review July 7, 2026 14:26

Andrei Kvapil (kvaps) requested review from IvanHunters, Andrey Kolkov (androndo), Aleksei Sviridkin (lexfrei), Timofei Larkin (lllamnyp), myasnikovdaniil and Kirill Ilin (sircthulhu) as code owners July 7, 2026 14:26

dosubot Bot added security Security-related issues and features security/fixed Fix released labels Jul 7, 2026

gemini-code-assist Bot reviewed Jul 7, 2026

View reviewed changes

IvanHunters approved these changes Jul 8, 2026

View reviewed changes

Aleksei Sviridkin (lexfrei) force-pushed the security/cve-2026-53359-disable-nested-virt branch 2 times, most recently from d0e7563 to 40e0a6f Compare July 8, 2026 22:30

Andrei Kvapil (kvaps) added 2 commits July 9, 2026 01:51

Aleksei Sviridkin (lexfrei) force-pushed the security/cve-2026-53359-disable-nested-virt branch from 40e0a6f to c440a7c Compare July 8, 2026 22:51

Aleksei Sviridkin (lexfrei) closed this Jul 9, 2026

Aleksei Sviridkin (lexfrei) deleted the security/cve-2026-53359-disable-nested-virt branch July 9, 2026 12:42

Aleksei Sviridkin (lexfrei) self-assigned this Jul 10, 2026

Navigation Menu

Uh oh!

test(e2e): disable KVM nested virtualization (CVE-2026-53359) - #3234

test(e2e): disable KVM nested virtualization (CVE-2026-53359)#3234
Andrei Kvapil (kvaps) wants to merge 2 commits into
mainfrom
security/cve-2026-53359-disable-nested-virt

Andrei Kvapil (kvaps) commented Jul 7, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 7, 2026 •

edited

Loading

Reviews paused

Walkthrough

Changes

Uh oh!

gemini-code-assist Bot commented Jul 7, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

IvanHunters left a comment

Uh oh!

Aleksei Sviridkin (lexfrei) commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Andrei Kvapil (kvaps) commented Jul 7, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

Release note

Related PRs

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Uh oh!

gemini-code-assist Bot commented Jul 7, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

IvanHunters left a comment

Choose a reason for hiding this comment

Uh oh!

Aleksei Sviridkin (lexfrei) commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Andrei Kvapil (kvaps) commented Jul 7, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 7, 2026 •

edited

Loading