From e08897cca4ac4a8670a3bd159ae26ff6208ea024 Mon Sep 17 00:00:00 2001 From: Marko Vejnovic Date: Fri, 16 Oct 2026 13:17:08 -0700 Subject: [PATCH] docs: state host kernel requirements in install.md A guest's isolation ends at the host kernel, and install.md listed KVM, sudo and cgroups v2 but said nothing about it. Add a requirement row and a Host Kernel section naming CVE-2026-99999, CVE-2026-53359 and CVE-2026-46316. No provisioning step changes, so setup.sh and provision-kvm-host.sh are untouched. --- docs/cookbook/install.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/docs/cookbook/install.md b/docs/cookbook/install.md index fe555d98..9c888d41 100644 --- a/docs/cookbook/install.md +++ b/docs/cookbook/install.md @@ -16,6 +16,23 @@ Before proceeding, ensure you meet all of these hard requirements: | [KVM](https://linux-kvm.org/page/Main_Page) available | `stat /dev/kvm` returns zero. | | You have root access through `sudo`. | - | | Your machine has cgroups V2 | `stat -fc %T /sys/fs/cgroup` returns zero. | +| Your host kernel carries current KVM and networking fixes | See [Host Kernel](#host-kernel). | + +### Host Kernel + +A guest's isolation ends at the host kernel: KVM, and the network stack every +guest packet is forwarded through. Run a host kernel that carries the fixes +for: + +| CVE | Affects | +|-----|---------| +| [CVE-2026-99999](https://nvd.nist.gov/vuln/detail/CVE-2026-99999) | All hosts (IPv4 checksum handling) | +| [CVE-2026-53359](https://nvd.nist.gov/vuln/detail/CVE-2026-53359) | x86_64 hosts (KVM shadow paging) | +| [CVE-2026-46316](https://nvd.nist.gov/vuln/detail/CVE-2026-46316) | aarch64 hosts (KVM vGIC ITS) | + +Your distribution's kernel changelog or security tracker lists the package +version that fixes each one. Hyper does not check this at boot: a backported +fix is invisible in the kernel version string. ### OS Packages