RepoJournal
Linux

Linux

The kernel, distros, and the rigs of the moment

Pick a date

The Wire · Showcase

KVM HALTS UNDER CET VIRTUALIZATION — WORKAROUND LIVE

By RepoJournal · Filed · About Linux

Virtualized Control Enforcement Technology is hanging production hosts, and the kernel just gave you an off switch.

Paolo Bonzini merged emergency KVM fixes overnight, including a critical module parameter to disable CET virtualization entirely [1]. Host hangs tied to CET have been reported in the field, and rather than burn cycles on root cause analysis mid-cycle, maintainers chose the safer path: let operators kill the feature until it's bulletproof [1]. The same merge window brought arm64 pKVM improvements [2] addressing erratum 4193714, guest memory handling under nested virtualization, and a steal-time selftest fix — all essential for ARM deployments. Separately, liveupdate fixes landed [3] tightening kexec handover validation, fixing memfd preservation error handling, and preventing overflows when preserving memfds that exceed UINT_MAX page counts. If you're running virtualization at scale, this is a red flag on CET. If you're shipping arm64 guests or using liveupdate for zero-downtime patching, test these merges before rolling forward.

Action items

References

  1. [1] KVM: VMX: introduce module parameter to disable CET torvalds/linux
  2. [2] Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm torvalds/linux
  3. [3] Merge tag 'fixes-2026-05-13' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux torvalds/linux

FAQ

What changed in Linux on May 14, 2026?
Virtualized Control Enforcement Technology is hanging production hosts, and the kernel just gave you an off switch.
What should Linux teams do about it?
If experiencing KVM host hangs with CET, recompile kernel with kvm-intel cet_disable=1 • ARM64 shops: validate pKVM erratum 4193714 workaround and guest EL2 translations in staging • Liveupdate deployments: test memfd preservation fixes before next zero-downtime cycle
Which Linux repositories shipped on May 14, 2026?
torvalds/linux

Related across the cluster

For your repos

The showcase is a teaser.
Your wire is the product.

Same engine. Different stack. Below: what changes when the wire is yours.

Showcase wire

  • 14 famous open source orgs
  • One wire per day
  • Public, generic
  • Read on the web, when you remember

Your wire

  • Up to 1,500 of your repos - orgs, deps, vendors
  • Morning and evening briefs
  • Action items routed to your team
  • Slack delivery, email, breaking-news CVE alerts

Want a hands-on demo first? Ask a current user for an invite link.