feat(blog): add CVE-2026-53359 (Januscape) security advisory

[Timur Tukaev (tym83)]

Summary

Publishes a security advisory blog post for CVE-2026-53359 ("Januscape"), a KVM guest-to-host escape that affects all current Talos kernels.

What

• New page bundle content/en/blog/2026-07-07-security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/ with index.md and a banner image.
• Explains the vulnerability, who is affected (clusters running VMs / tenant Kubernetes), the risk, and the recommended mitigation: disable nested virtualization via Talos machine.install kernel args (and the generic-Linux equivalent).
• Links to the automation PR (cozystack/ccp#17) and the cozystack:talos-bootstrap / cozystack:cluster-upgrade skills.

Why

An exploit is public and no fixed Talos image has shipped yet, so operators need the mitigation now. Publishing it on the blog gives the community an authoritative, linkable reference.

Preview

• Author: Cozystack Team
• Date: 2026-07-07
• OG image: cve-2026-53359-banner.png (1200×627)
• Follows the existing blog conventions (page bundle, frontmatter, figure shortcode, "Join the community" block).

Summary by CodeRabbit

• Documentation
  • Added a new security advisory covering CVE-2026-53359 (“Januscape”), including affected environments, risk details, and recommended mitigation steps.
  • Included guidance for Talos and generic Linux hosts on reducing exposure by disabling nested virtualization, plus follow-up notes for updated releases and automation options.

[netlify]

❌ Deploy Preview for cozystack failed.

Name	Link
🔨 Latest commit	e2adc55
🔍 Latest deploy log	https://app.netlify.com/projects/cozystack/deploys/6a4dfc211a78f600086af4b5

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ebccf656-ea37-424e-a789-bee7359bb4ea

📥 Commits

Reviewing files that changed from the base of the PR and between f5e48b1 and e2adc55.

⛔ Files ignored due to path filters (1)

• content/en/blog/2026-07-07-security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/cve-2026-53359-banner.png is excluded by !**/*.png

📒 Files selected for processing (1)

• content/en/blog/2026-07-07-security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/index.md

---

📝 Walkthrough

Walkthrough

Adds a new blog post documenting security advisory CVE-2026-53359 ("Januscape"), a KVM/x86 shadow MMU use-after-free affecting Talos kernels, including impact description, mitigation via disabling nested virtualization on Talos and generic Linux hosts, automation notes, and post-fix guidance.

Changes

Security Advisory Blog Post

Layer / File(s)	Summary
Advisory front matter and summary content/en/blog/2026-07-07-security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/index.md	Adds front matter, severity/status callout, "What happened," "Who is affected," and "The risk" sections.
Mitigation instructions content/en/blog/2026-07-07-security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/index.md	Adds Talos-specific kernel argument mitigation (via talm apply/talm upgrade) and generic Linux modprobe-based mitigation for disabling nested virtualization.
Automation, follow-up, and community links content/en/blog/2026-07-07-security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/index.md	Adds notes on Cozystack Claude Code skill automation, guidance for after a fixed Talos release ships, and community channel links.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: kvaps, lllamnyp

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch blog/security-advisory-cve-2026-53359-januscape

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request adds a security advisory blog post for CVE-2026-53359 ("Januscape"), a KVM guest-to-host escape vulnerability affecting Talos kernels, detailing mitigation steps by disabling nested virtualization. The review feedback suggests critical clarifications regarding Talos boot configuration: specifically, that extraKernelArgs is ignored on UEFI/UKI systems using systemd-boot (even on Talos >= 1.12) and requires baking the arguments into the boot image. Additionally, it recommends noting that all running VMs must be stopped before reloading the kvm module on generic Linux hosts.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

On UEFI/UKI systems using systemd-boot (the default for UEFI installations since Talos 1.10), extraKernelArgs is always ignored because the kernel command line is embedded directly in the Unified Kernel Image (UKI). The grubUseUKICmdline option is specific to the GRUB bootloader (used for legacy BIOS or upgraded systems) and has no effect on systemd-boot systems.\n\nSetting grubUseUKICmdline: false will not make extraKernelArgs work on default UEFI/UKI systems. For those systems, the kernel arguments must be baked into the boot image via the Image Factory or imager. We should clarify this to prevent a false sense of security.

Suggested change

	# Talos >= 1.12 only: pin grubUseUKICmdline false so the args are applied
	# (otherwise they are silently ignored on UEFI/UKI systems).
	grubUseUKICmdline: false
	# For GRUB-based systems on Talos >= 1.12: pin grubUseUKICmdline false so the args are applied.\n # Note: This has no effect on systemd-boot UEFI/UKI systems, where extraKernelArgs is always ignored.\n grubUseUKICmdline: false

[gemini-code-assist]

Clarify that even on Talos >= 1.12, UEFI/UKI nodes using systemd-boot still ignore extraKernelArgs and require the arguments to be baked into the boot image.

Suggested change

Both lines are safe on Intel and AMD — the one that does not match your CPU is ignored. On Talos **older than 1.12** the `grubUseUKICmdline` field does not exist and `extraKernelArgs` is ignored on UEFI/UKI nodes; there the args must be baked into the boot image via Image Factory.

Both lines are safe on Intel and AMD — the one that does not match your CPU is ignored. On UEFI/UKI nodes using systemd-boot (the default for UEFI since Talos 1.10, regardless of the Talos version), extraKernelArgs is always ignored and the arguments must be baked into the boot image via Image Factory or imager. The grubUseUKICmdline field only applies to GRUB-based installations (legacy BIOS or upgraded nodes) on Talos >= 1.12.

[gemini-code-assist]

Reloading the kvm module will fail with a "module is in use" error if any virtual machines are currently running on the host. It is helpful to remind operators to stop all running VMs before attempting to reload the module.

Suggested change

	Then reboot the node (or reload the `kvm` module) for it to take effect.
	Then reboot the node (or stop all running VMs and reload the kvm module) for it to take effect.