The Wire · Showcase
KVM HALTS UNDER CET VIRTUALIZATION — WORKAROUND LIVE
By RepoJournal · Filed · About Linux
Virtualized Control Enforcement Technology is hanging production hosts, and the kernel just gave you an off switch.
Paolo Bonzini merged emergency KVM fixes overnight, including a critical module parameter to disable CET virtualization entirely [1]. Host hangs tied to CET have been reported in the field, and rather than burn cycles on root cause analysis mid-cycle, maintainers chose the safer path: let operators kill the feature until it's bulletproof [1]. The same merge window brought arm64 pKVM improvements [2] addressing erratum 4193714, guest memory handling under nested virtualization, and a steal-time selftest fix — all essential for ARM deployments. Separately, liveupdate fixes landed [3] tightening kexec handover validation, fixing memfd preservation error handling, and preventing overflows when preserving memfds that exceed UINT_MAX page counts. If you're running virtualization at scale, this is a red flag on CET. If you're shipping arm64 guests or using liveupdate for zero-downtime patching, test these merges before rolling forward.
Action items
- → If experiencing KVM host hangs with CET, recompile kernel with kvm-intel cet_disable=1 torvalds/linux [immediate]
- → ARM64 shops: validate pKVM erratum 4193714 workaround and guest EL2 translations in staging torvalds/linux [plan]
- → Liveupdate deployments: test memfd preservation fixes before next zero-downtime cycle torvalds/linux [plan]
References
- [1] KVM: VMX: introduce module parameter to disable CET torvalds/linux
- [2] Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm torvalds/linux
- [3] Merge tag 'fixes-2026-05-13' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux torvalds/linux
FAQ
- What changed in Linux on May 14, 2026?
- Virtualized Control Enforcement Technology is hanging production hosts, and the kernel just gave you an off switch.
- What should Linux teams do about it?
- If experiencing KVM host hangs with CET, recompile kernel with kvm-intel cet_disable=1 • ARM64 shops: validate pKVM erratum 4193714 workaround and guest EL2 translations in staging • Liveupdate deployments: test memfd preservation fixes before next zero-downtime cycle
- Which Linux repositories shipped on May 14, 2026?
- torvalds/linux