CVE-2026-43499 (GhostLock): Cozystack Exposure Assessment

Tue, 14 Jul 2026 00:00:00 +0000

Third CVE this week — but good news: Cozystack isn’t exposed by design, and the fix is the same v1.13.6 upgrade you already know. Details below.

TL;DR: CVE-2026-43499 (“GhostLock”) is a Linux kernel local privilege escalation. By the design of Cozystack, we currently see no viable attack path for a tenant to reach the affected host kernel surface. We still recommend the fix — and it is the same Talos v1.13.6 upgrade that closes Januscape (CVE-2026-53359) and CVE-2026-46113. One move to v1.13.6 closes all three.

Fixing CVE-2026-53359 (Januscape) and CVE-2026-46113 on Talos Linux

Tue, 14 Jul 2026 00:00:00 +0000

Update on CVE-2026-53359 (“Januscape”): the proper fix is here.

Our earlier mitigation was a hotfix — a temporary, forced measure. The proper fix is now available, so the hotfix is no longer needed.

TL;DR: Disabling nested virtualization is no longer needed. It was a hotfix, and for some setups it wasn’t even possible. The real fix is a kernel bump. If you already applied the hotfix, roll it back and upgrade instead.

Talos on Cozystack

CVE-2026-43499 (GhostLock): Cozystack Exposure Assessment

Fixing CVE-2026-53359 (Januscape) and CVE-2026-46113 on Talos Linux