KubeVirt
v1.6.4Orchestration & ManagementKubeVirt v1.6.4 is a patch release with 108 changes targeting stability: a CVE fix in crypto, several hotplug/migration bugs squashed, and new vCPU queue alerting.
securityPatch CVE-2025-47913 — upgrade to v1.6.4 now
CVE-2025-47913 affects the golang/x/crypto dependency. This release pins it to OpenShift's patched fork. If you're running any v1.6.x release before v1.6.4, you're exposed. Upgrade immediately — no workaround exists short of patching the binary yourself.
breakingCross-vendor live migrations are now blocked
KubeVirt will now explicitly prevent live migrations between nodes with different CPU vendors (e.g., Intel to AMD). If your cluster has mixed CPU vendors and you've been relying on cross-vendor migration — intentionally or not — audit your node topology before upgrading. Migrations that previously succeeded may now fail with an error.
enhancementAdd vCPU queue alerts to your monitoring setup
Two new alerts ship in this release: GuestPeakVCPUQueueHighWarning and GuestPeakVCPUQueueHighCritical. If you're running KubeVirt with Prometheus, check that these alerts are picked up by your alerting rules. They give you early warning on guest CPU starvation, which is otherwise invisible until VMs start misbehaving under load.
Key changes (5)
- CVE-2025-47913 remediated by redirecting golang/x/crypto to the patched openshift/golang-crypto module
- PCI address stability fixed across upgrades when using v3 hotplug port topology
- Block volume hotplug no longer breaks autoattachVSOCK
- New Prometheus alerts: GuestPeakVCPUQueueHighWarning and GuestPeakVCPUQueueHighCritical for guest CPU saturation visibility
- Memory overcommit is now recalculated on live migration, and cross-vendor migrations are explicitly blocked