Skip to content

Commit 40e0a6f

Browse files
kvapslexfrei
kvaps
authored and
lexfrei
committed
fix(e2e): pin grubUseUKICmdline=false so kvm nested args apply on Talos >=1.12 (CVE-2026-53359)
On Talos >1.11 the base defaults machine.install.grubUseUKICmdline=true (UKI cmdline), which Talos rejects together with extraKernelArgs and which ignores them anyway. Pin it false so the nested=0 args land on the Talos-built cmdline. Signed-off-by: Andrei Kvapil <[email protected]> Assisted-By: Claude <[email protected]>
1 parent 286d7af commit 40e0a6f

1 file changed

Lines changed: 4 additions & 0 deletions

File tree

‎hack/e2e-prepare-cluster.bats‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,10 @@ machine:
133133
- name: zfs
134134
- name: spl
135135
install:
136+
# On Talos >1.11 the base defaults grubUseUKICmdline: true (UKI cmdline),
137+
# which Talos rejects together with extraKernelArgs and which ignores them
138+
# anyway; pin false so the kvm args land on the Talos-built cmdline.
139+
grubUseUKICmdline: false
136140
extraKernelArgs:
137141
# CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation)
138142
- kvm_intel.nested=0

0 commit comments

Comments
 (0)