{"uuid": "044ad11f-0b84-4cbb-bbd6-4d39af294a63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46113", "type": "seen", "source": "https://t.me/aenix_io/426", "content": "\ud83d\udc8a Fixing CVE-2026-53359 (Januscape) + CVE-2026-46113 on Talos Linux\n\nContext\nCVE-2026-53359 (Januscape) and CVE-2026-46113 are KVM x86 shadow-paging use-after-free bugs that let a guest VM escape to the host. Both are fixed in Linux 6.18.38, which ships in Talos v1.13.6. Upgrading to it closes both at the kernel level \u2014 you do not need to disable nested virtualization.\n\nThe commonly suggested config mitigation:\nmachine.install.extraKernelArgs: [kvm_intel.nested=0, kvm_amd.nested=0] \u2014 is silently ignored on systemd-boot / UKI nodes (the usual bare-metal UEFI case):\n\nkvm_intel/kvm_amd are built into the Talos kernel, so modprobe.d and runtime /sys writes don\u2019t apply (/sys/module/kvm_intel/parameters/nested is 0444); nested= is settable only via the kernel command line.\nOn systemd-boot the cmdline is baked into the signed UKI, so extraKernelArgs are dropped (Talos warns extra kernel arguments are not supported when booting using SDBoot). grubUseUKICmdline: false only helps GRUB nodes.\n\nSo the fix is a kernel bump, not a config knob.\n\nRunbook\n\n1. Build an Image Factory schematic with your extensions\nIf your nodes use system extensions (drbd, zfs, firmware, GPU, ucode), declare them \u2014 Image Factory assembles the stock installer plus the official extensions, no custom image build required.\n\ncat > schematic.yaml <<'YAML'\ncustomization:\n  systemExtensions:\n    officialExtensions:\n      - siderolabs/drbd\n      - siderolabs/zfs\n      - siderolabs/amd-ucode\n      - siderolabs/intel-ucode\n      - siderolabs/amdgpu\n      - siderolabs/i915\n      - siderolabs/bnx2-bnx2x\n      - siderolabs/intel-ice-firmware\n      - siderolabs/qlogic-firmware\nYAML\n\ncurl -sX POST --data-binary @schematic.yaml https://factory.talos.dev/schematics\n# -> {\"id\":\"\"}\n\nTrim the extension list to what your cluster actually uses.\n\n2. Upgrade node-by-node\n\ntalosctl -n  upgrade \\\n  --image factory.talos.dev/installer/:v1.13.6\n\nRoll one node at a time; on control-plane nodes wait for etcd and your CSI/storage to be healthy between nodes. Talos only tests migrations between adjacent minors \u2014 from an old release, upgrade sequentially through each minor\u2019s latest patch rather than jumping straight.\n\n3. Verify\n\ntalosctl -n  version                          # Server: v1.13.6\ntalosctl -n  read /proc/sys/kernel/osrelease  # 6.18.38-talos\ntalosctl -n  get extensions                   # your extensions present\n\nkvm_intel.nested may stay Y \u2014 that\u2019s expected; the vulnerable path is fixed in the kernel.\n\nReady installer (Cozystack extension set)\n\nStandard Cozystack extensions (drbd, zfs, amd/intel-ucode, amdgpu, i915, bnx2-bnx2x, intel-ice-firmware, qlogic-firmware):\n\nfactory.talos.dev/installer/be66fdc8a38c2f517f33cba0a6daa7ab97ff87d51e8ca7d2160e45911ba09cf5:v1.13.6\n\nReferences:\n\nCVE-2026-53359 (Januscape): \nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53359\nCVE-2026-46113: https://nvd.nist.gov/vuln/detail/CVE-2026-46113\n\nTalos bootloader / UKI cmdline: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/bare-metal-platforms/bootloader\n\nTalos Image Factory: https://factory.talos.dev", "creation_timestamp": "2026-07-29T12:00:04.505455Z"}