feat(blog): add Talos fix guide for CVE-2026-53359 (Januscape) - #612
Conversation
Add a blog post explaining that the proper fix for CVE-2026-53359 (Januscape) and CVE-2026-46113 is a kernel bump to Talos v1.13.6 (Linux 6.18.38), superseding the earlier nested-virtualization hotfix, with a node-by-node Talos upgrade runbook. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: tym83 <6355522@gmail.com>
✅ Deploy Preview for cozystack ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
📝 WalkthroughWalkthroughAdds a blog post announcing the Talos Linux kernel fix for two CVEs, explaining nested virtualization mitigation limitations, and documenting a Talos v1.13.6 upgrade and verification runbook. ChangesTalos CVE Fix Documentation
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new blog post detailing the proper fix for CVE-2026-53359 (Januscape) and CVE-2026-46113 on Talos Linux, emphasizing a kernel upgrade over disabling nested virtualization. Feedback suggests updating a link within the post to reference the previous Cozystack security advisory instead of the external NVD page for better context.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
|
|
||
| **Update on CVE-2026-53359 ("Januscape"): the proper fix is here.** | ||
|
|
||
| Our [earlier mitigation](https://nvd.nist.gov/vuln/detail/CVE-2026-53359) was a hotfix — a temporary, forced measure. The proper fix is now available, so the hotfix is no longer needed. |
There was a problem hiding this comment.
The link for "earlier mitigation" currently points to the NVD page for CVE-2026-53359. It would be much more helpful and contextually accurate to link directly to the previous Cozystack security advisory blog post (/blog/security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/) which describes the hotfix in detail.
| Our [earlier mitigation](https://nvd.nist.gov/vuln/detail/CVE-2026-53359) was a hotfix — a temporary, forced measure. The proper fix is now available, so the hotfix is no longer needed. | |
| Our [earlier mitigation](/blog/security-advisory-cve-2026-53359-januscape-kvm-guest-to-host-escape/) was a hotfix — a temporary, forced measure. The proper fix is now available, so the hotfix is no longer needed. |
## Summary New security advisory blog post: **CVE-2026-43499 ("GhostLock")** is a Linux kernel local privilege escalation. Cozystack is **not exposed by design**, and the fix is the **same Talos v1.13.6 upgrade** that closes Januscape (CVE-2026-53359) and CVE-2026-46113. ## What - Describes the vulnerability (rtmutex / futex(2) stack use-after-free, container-escape potential). - Explains why Cozystack tenants have no path to the affected host kernel surface (guest-VM isolation, unprivileged managed databases, no arbitrary tenant code on management nodes). - Recommends the kernel fix anyway (defense in depth) and cross-links the Januscape upgrade runbook. ## Why Third kernel CVE this week; operators need a clear, factual exposure statement plus the single upgrade that resolves all three. ## Preview Page bundle at `content/en/blog/2026-07-14-cve-2026-43499-ghostlock-cozystack-exposure-assessment/` with social-card image and SEO frontmatter. Depends on / cross-links PR #612.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@content/en/blog/2026-07-14-fixing-cve-2026-53359-januscape-talos-linux/index.md`:
- Around line 42-44: Add the text language identifier to both fenced code blocks
in the blog post, including the block containing the kernel version list and the
other fence reported by MD040, without changing their contents.
- Line 24: Update the “earlier mitigation” link in the advisory content to
reference the prior Cozystack security-advisory post identified by the supplied
context, while retaining the NVD CVE reference as an additional link if needed.
Ensure readers can access the earlier hotfix details for comparison and
rollback.
- Line 105: Update the verification guidance in the blog post to be CPU-neutral:
mention checking kvm_intel.nested on Intel systems and kvm_amd.nested on AMD
systems, while preserving the statement that the nested setting may remain
enabled because the vulnerable kernel path is fixed.
- Around line 40-46: Update the “Safe kernel versions across all stable
branches” section to avoid describing 7.2-rc1 as a stable branch, and replace
the generic-host guidance in the surrounding version guidance with exact
branch-specific fixed versions rather than “6.18.38 or newer.” Preserve the
listed fixed versions and clearly distinguish stable branches from the
release-candidate version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 25fec744-ea60-435f-baca-b3f0d5729a5f
⛔ Files ignored due to path filters (1)
content/en/blog/2026-07-14-fixing-cve-2026-53359-januscape-talos-linux/januscape-talos-fix.pngis excluded by!**/*.png
📒 Files selected for processing (1)
content/en/blog/2026-07-14-fixing-cve-2026-53359-januscape-talos-linux/index.md
|
|
||
| **Update on CVE-2026-53359 ("Januscape"): the proper fix is here.** | ||
|
|
||
| Our [earlier mitigation](https://nvd.nist.gov/vuln/detail/CVE-2026-53359) was a hotfix — a temporary, forced measure. The proper fix is now available, so the hotfix is no longer needed. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Link “earlier mitigation” to the prior Cozystack advisory.
The NVD page documents the CVE, but not Cozystack’s earlier hotfix. Link the previous security-advisory post here, or include both links, so readers can compare and roll back the old mitigation.
Based on the supplied prior advisory snippet, that post is the relevant source for the earlier mitigation context.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@content/en/blog/2026-07-14-fixing-cve-2026-53359-januscape-talos-linux/index.md`
at line 24, Update the “earlier mitigation” link in the advisory content to
reference the prior Cozystack security-advisory post identified by the supplied
context, while retaining the NVD CVE reference as an additional link if needed.
Ensure readers can access the earlier hotfix details for comparison and
rollback.
| Safe kernel versions across all stable branches: | ||
|
|
||
| ``` | ||
| 6.1.177 · 6.6.144 · 6.12.95 · 6.18.38 · 7.1.3 · 7.2-rc1 | ||
| ``` | ||
|
|
||
| - **Generic Linux hosts (non-Talos):** upgrade to **Linux 6.18.38 or newer** (or the patched version from your branch above), then reboot. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sed -n '1,140p' content/en/blog/2026-07-14-fixing-cve-2026-53359-januscape-talos-linux/index.mdRepository: cozystack/website
Length of output: 6471
🌐 Web query:
CVE-2026-46113 NVD affected versions fixed 6.19 7.0.7
💡 Result:
CVE-2026-46113 is a security vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) x86 shadow paging mechanism [1][2]. The flaw is a use-after-free error caused by unexpected Guest Frame Number (GFN) handling, which can occur during guest-initiated page table changes [3][4]. According to the National Vulnerability Database (NVD) and related security trackers, the affected Linux kernel versions are those containing the vulnerable shadow paging logic [1][4]. The vulnerability is considered resolved in the following stable versions [1][4]: - 6.1.176 and later - 6.6.140 and later - 6.12.88 and later - 6.18.30 and later - 7.0.7 and later Versions prior to 2.6.20 are generally considered unaffected by this specific issue as they did not contain the corresponding shadow paging logic [1][4]. Users are advised to update to a patched kernel version to mitigate this vulnerability [5][4].
Citations:
- 1: https://nvd.nist.gov/vuln/detail/CVE-2026-46113
- 2: https://access.redhat.com/security/cve/cve-2026-46113
- 3: https://osv.dev/vulnerability/CVE-2026-46113
- 4: https://app.opencve.io/cve/CVE-2026-46113
- 5: https://security-tracker.debian.org/tracker/CVE-2026-46113
🌐 Web query:
site:nvd.nist.gov CVE-2026-46113 6.18.30 7.0.7 affected versions
💡 Result:
CVE-2026-46113 is a vulnerability in the Linux kernel related to KVM (Kernel-based Virtual Machine) x86 shadow paging, specifically involving a use-after-free issue caused by an unexpected Guest Frame Number (GFN) [1]. According to official vulnerability data, the affected versions include all Linux kernel versions from 2.6.20 up to, but not including, the versions that contain the fix [1]. Specifically, the vulnerability is reported as resolved in versions 6.1.175, 6.6.140, 6.12.88, 6.18.30, and 7.0.7 [1]. Consequently, kernels newer than or equal to these versions are generally considered unaffected [1]. In summary, the vulnerability affects Linux kernel versions [1]: - Starting from 2.6.20. - Up to (but excluding) 6.1.175. - Up to (but excluding) 6.6.140. - Up to (but excluding) 6.12.88. - Up to (but excluding) 6.18.30. - Up to (but excluding) 7.0.7. The fix for this issue was upstreamed in version 7.1 [1]. The vulnerability arises when a shadow paging mismatch between the stored and computed GFN occurs, which can be triggered by changing a PDE (Page Directory Entry) mapping from outside the guest and subsequently deleting a memory slot [1][2]. This can lead to a use-after-free condition when the KVM shadow page is freed but an rmap entry incorrectly survives, causing subsequent memory accesses to dereference freed memory [1][2].
Citations:
- 1: https://nvd.nist.gov/vuln/detail/CVE-2026-46113
- 2: https://nvd.nist.gov/vuln/detail/cve-2026-53359
Use exact fixed versions, not “or newer.”
Linux 6.18.38 or newer overstates the safe range; keep the branch-specific fixed versions instead, and rename the heading so 7.2-rc1 isn’t presented as a stable branch.
Suggested wording
-Safe kernel versions across all stable branches:
+Known fixed kernel versions:
-**Generic Linux hosts (non-Talos):** upgrade to **Linux 6.18.38 or newer** (or the patched version from your branch above), then reboot.
+**Generic Linux hosts (non-Talos):** upgrade to one of the exact fixed versions listed above, or your vendor's branch-specific backport, then reboot.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| Safe kernel versions across all stable branches: | |
| ``` | |
| 6.1.177 · 6.6.144 · 6.12.95 · 6.18.38 · 7.1.3 · 7.2-rc1 | |
| ``` | |
| - **Generic Linux hosts (non-Talos):** upgrade to **Linux 6.18.38 or newer** (or the patched version from your branch above), then reboot. | |
| Known fixed kernel versions: | |
🧰 Tools
🪛 markdownlint-cli2 (0.23.0)
[warning] 42-42: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@content/en/blog/2026-07-14-fixing-cve-2026-53359-januscape-talos-linux/index.md`
around lines 40 - 46, Update the “Safe kernel versions across all stable
branches” section to avoid describing 7.2-rc1 as a stable branch, and replace
the generic-host guidance in the surrounding version guidance with exact
branch-specific fixed versions rather than “6.18.38 or newer.” Preserve the
listed fixed versions and clearly distinguish stable branches from the
release-candidate version.
Source: MCP tools
| ``` | ||
| 6.1.177 · 6.6.144 · 6.12.95 · 6.18.38 · 7.1.3 · 7.2-rc1 | ||
| ``` |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Add language identifiers to the plain-text fences.
markdownlint MD040 flags both fenced blocks. Add text after each opening fence.
Based on static-analysis output, both fences are reported by MD040.
Also applies to: 111-113
🧰 Tools
🪛 markdownlint-cli2 (0.23.0)
[warning] 42-42: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@content/en/blog/2026-07-14-fixing-cve-2026-53359-januscape-talos-linux/index.md`
around lines 42 - 44, Add the text language identifier to both fenced code
blocks in the blog post, including the block containing the kernel version list
and the other fence reported by MD040, without changing their contents.
Source: Linters/SAST tools
| talosctl -n <NODE_IP> get extensions # your extensions present | ||
| ``` | ||
|
|
||
| `kvm_intel.nested` may stay `Y` — that's expected. The vulnerable path is fixed in the kernel. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Make the verification step CPU-neutral.
The post covers both Intel and AMD, but only names kvm_intel.nested. Tell AMD readers to check kvm_amd.nested instead.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@content/en/blog/2026-07-14-fixing-cve-2026-53359-januscape-talos-linux/index.md`
at line 105, Update the verification guidance in the blog post to be
CPU-neutral: mention checking kvm_intel.nested on Intel systems and
kvm_amd.nested on AMD systems, while preserving the statement that the nested
setting may remain enabled because the vulnerable kernel path is fixed.
1 participant
Summary
New blog post: the proper fix for CVE-2026-53359 ("Januscape") and CVE-2026-46113 is a kernel bump to Talos v1.13.6 (Linux 6.18.38), not disabling nested virtualization.
What
Why
Tenant Kubernetes nodes are KubeVirt VMs, so these KVM guest-escape CVEs are directly relevant to Cozystack operators. This post gives them the canonical remediation.
Preview
Page bundle at
content/en/blog/2026-07-14-fixing-cve-2026-53359-januscape-talos-linux/with social-card image and SEO frontmatter (title, description, og image, article_types, topics).Summary by CodeRabbit