fix(talos): bump Talos to v1.12.7 (CVE-2026-31431) by kvaps · Pull Request #2545 · cozystack/cozystack

Andrei Kvapil (kvaps) · 2026-04-30T21:09:46Z

What this PR does

Bumps Talos Linux from v1.12.6 to v1.12.7, which includes the kernel fix for CVE-2026-31431 ("Copy Fail") — an unprivileged-to-root local privilege escalation in the Linux kernel crypto subsystem (algif_aead).

This also refreshes the bundled system extension digests (amd-ucode, amdgpu, bnx2-bnx2x, i915, intel-ice-firmware, qlogic-firmware, drbd, zfs) to their 1.12.7-aligned builds.

Generated via make update in packages/core/talos.

References:

Release note

fix(talos): bump Talos Linux to v1.12.7, picking up the kernel fix for CVE-2026-31431 ("Copy Fail")

Summary by CodeRabbit

Chores
- Upgraded Talos profiles (initramfs, installer, ISO, kernel, metal, nocloud) from v1.12.6 to v1.12.7
- Refreshed base installer and system extension image references across all deployment targets

Bumps Talos Linux from v1.12.6 to v1.12.7, which includes the kernel fix for CVE-2026-31431 ("Copy Fail") — an unprivileged-to-root local privilege escalation in the Linux kernel crypto subsystem (algif_aead). Also refreshes the bundled system extension digests (amd-ucode, amdgpu, bnx2-bnx2x, i915, intel-ice-firmware, qlogic-firmware, drbd, zfs) to their 1.12.7-aligned builds. Generated via `make update` in packages/core/talos. Co-Authored-By: Claude <[email protected]> Signed-off-by: Andrei Kvapil <[email protected]>

coderabbitai · 2026-04-30T21:09:53Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 70e90538-b612-4e3f-8c49-1edd02cb4b49

📥 Commits

Reviewing files that changed from the base of the PR and between 6c2dba9 and 8549f3b.

📒 Files selected for processing (6)

packages/core/talos/images/talos/profiles/initramfs.yaml
packages/core/talos/images/talos/profiles/installer.yaml
packages/core/talos/images/talos/profiles/iso.yaml
packages/core/talos/images/talos/profiles/kernel.yaml
packages/core/talos/images/talos/profiles/metal.yaml
packages/core/talos/images/talos/profiles/nocloud.yaml

📝 Walkthrough

Walkthrough

Six Talos profile configuration files are updated from version v1.12.6 to v1.12.7, with corresponding updates to the base installer image reference and system extension image tags and digests across initramfs, installer, ISO, kernel, metal, and nocloud profiles.

Changes

Cohort / File(s)	Summary
Talos Profile Version Updates `packages/core/talos/images/talos/profiles/{initramfs,installer,iso,kernel,metal,nocloud}.yaml`	Version bumped from v1.12.6 to v1.12.7; baseInstaller image reference updated to v1.12.7; systemExtensions image references refreshed for amd-ucode, amdgpu, bnx2-bnx2x, intel-ice-firmware, i915, qlogic-firmware, drbd, and zfs with new tags and SHA256 digests.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 Version hops forward, tags all aligned,
Six profiles refreshed, v1.12.7 signed,
Extensions updated with digests so bright,
Talos systems configured just right! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: bumping Talos to v1.12.7 to address CVE-2026-31431. It is concise, specific, and directly relates to the changeset across all modified YAML files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/talos-1.12.7

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Review rate limit: 7/8 reviews remaining, refill in 7 minutes and 30 seconds.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist · 2026-04-30T21:14:24Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request performs a routine version bump for Talos Linux to address a security vulnerability. By updating to v1.12.7, the system incorporates necessary kernel patches to mitigate a local privilege escalation risk. Additionally, the associated system extension images have been updated to ensure compatibility and consistency with the new version.

Highlights

Talos Linux Version Bump: Updated Talos Linux from v1.12.6 to v1.12.7 to include the critical kernel fix for CVE-2026-31431.
System Extension Refresh: Refreshed all bundled system extension digests (including amd-ucode, amdgpu, bnx2-bnx2x, i915, intel-ice-firmware, qlogic-firmware, drbd, and zfs) to align with the v1.12.7 release.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	Gemini (@gemini-code-assist)	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request updates the Talos profiles across several configurations, including initramfs, installer, iso, kernel, metal, and nocloud, by bumping the version from v1.12.6 to v1.12.7. It also updates the image references and digests for various system extensions such as firmware for AMD, Intel, and QLogic, along with DRBD and ZFS modules. I have no feedback to provide.

github-actions · 2026-05-01T10:55:45Z

Successfully created backport PR for release-1.3:

[Backport release-1.3] fix(talos): bump Talos to v1.12.7 (CVE-2026-31431) #2547

github-actions · 2026-05-01T10:55:45Z

Successfully created backport PR for release-1.2:

[Backport release-1.2] fix(talos): bump Talos to v1.12.7 (CVE-2026-31431) #2548

## What this PR does Bumps Talos Linux from v1.12.7 to v1.13.0. The v1.13 release line also contains the kernel fix for CVE-2026-31431 ("Copy Fail"). Refreshes the bundled system extension digests (amdgpu, i915, drbd, zfs) to their 1.13.0-aligned builds. Generated via `make update` in `packages/core/talos`. Stacked on top of #2545. Targets `fix/talos-1.12.7` so the diff shown here is just the v1.12.7 → v1.13.0 delta. References: - https://copy.fail/ - https://www.siderolabs.com/blog/exploit-fail-cve-2026-31431-copy-fail-barely-scratches-talos-linux ### Release note ```release-note feat(talos): bump Talos Linux to v1.13.0 ```

) (#2547) # Description Backport of #2545 to `release-1.3`.

) (#2548) # Description Backport of #2545 to `release-1.2`.

Andrei Kvapil (kvaps) added kind/backport Categorizes issue or PR as requiring a backport to the current release line kind/backport-previous Categorizes issue or PR as requiring a backport to the previous release line labels Apr 30, 2026

github-actions Bot added area/platform Issues or PRs related to platform infrastructure (bundle, flux, talos, installer) kind/bug Categorizes issue or PR as related to a bug labels Apr 30, 2026

Andrei Kvapil (kvaps) marked this pull request as ready for review April 30, 2026 21:14

Andrei Kvapil (kvaps) requested review from IvanHunters, Andrey Kolkov (androndo), Aleksei Sviridkin (lexfrei), Timofei Larkin (lllamnyp), myasnikovdaniil and Kirill Ilin (sircthulhu) as code owners April 30, 2026 21:14

dosubot Bot added the size/XS This PR changes 0-9 lines, ignoring generated files label Apr 30, 2026

Andrei Kvapil (kvaps) enabled auto-merge April 30, 2026 21:14

dosubot Bot added priority/critical-urgent Highest priority. Must be actively worked on as someone's top priority right now security Security-related issues and features security/fixed Fix released labels Apr 30, 2026

gemini-code-assist Bot reviewed Apr 30, 2026

View reviewed changes

Andrei Kvapil (kvaps) mentioned this pull request Apr 30, 2026

feat(talos): bump Talos to v1.13.0 #2546

Merged

Aleksei Sviridkin (lexfrei) approved these changes May 1, 2026

View reviewed changes

Andrei Kvapil (kvaps) merged commit 431eac8 into main May 1, 2026
21 checks passed

dosubot Bot added the lgtm This PR has been approved by a maintainer label May 1, 2026

Andrei Kvapil (kvaps) deleted the fix/talos-1.12.7 branch May 1, 2026 10:55

This was referenced May 1, 2026

[Backport release-1.3] fix(talos): bump Talos to v1.12.7 (CVE-2026-31431) #2547

Merged

[Backport release-1.2] fix(talos): bump Talos to v1.12.7 (CVE-2026-31431) #2548

Merged

Andrei Kvapil (kvaps) added a commit that referenced this pull request May 1, 2026

[Backport release-1.3] fix(talos): bump Talos to v1.12.7 (CVE-2026-31431

c4dca43

) (#2547) # Description Backport of #2545 to `release-1.3`.

Andrei Kvapil (kvaps) added a commit that referenced this pull request May 1, 2026

[Backport release-1.2] fix(talos): bump Talos to v1.12.7 (CVE-2026-31431

702a6f9

) (#2548) # Description Backport of #2545 to `release-1.2`.

Navigation Menu

Repository navigation

fix(talos): bump Talos to v1.12.7 (CVE-2026-31431) - #2545

fix(talos): bump Talos to v1.12.7 (CVE-2026-31431)#2545
Andrei Kvapil (kvaps) merged 1 commit into
mainfrom
fix/talos-1.12.7

Andrei Kvapil (kvaps) commented Apr 30, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Apr 30, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

gemini-code-assist Bot commented Apr 30, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

github-actions Bot commented May 1, 2026

Uh oh!

github-actions Bot commented May 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Andrei Kvapil (kvaps) commented Apr 30, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

Release note

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

gemini-code-assist Bot commented Apr 30, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

github-actions Bot commented May 1, 2026

Uh oh!

github-actions Bot commented May 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Andrei Kvapil (kvaps) commented Apr 30, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Apr 30, 2026 •

edited

Loading