Talos Node in Kexec / Reboot Loop, Never Installs

Symptom: The VM console shows Talos booting, completing the installation kexec, then the UEFI boot menu appears instead of the installed OS, and the cycle repeats. The STATE volume is never found and the node never joins Kubernetes.

Console pattern:

[talos] task kexecPrepare (1/1): starting
[talos] sd-boot: found UKI files: [Talos-v1.13.0.efi]
[talos] prepared kexec environment ... cmdline="talos.platform=metal ..."
[talos] task reboot (1/1): starting
kvm: exiting hardware virtualization
kexec_core: Starting new kernel
BdsDxe: loading Boot0001 "UEFI Misc Device" from ...
      Talos (v1.13.0)   ►   Talos (v1.13.0) (Reset to maintenance mode)
      Boot in 5s. ████████████████████████████████████████

After the 5-second countdown, the whole cycle restarts.

---

Root Cause A — Missing KSPP kernel parameters

Talos 1.9+ enforces Kernel Self-Protection Project (KSPP) requirements. The installer checks for slab_nomerge and pti=on in the kernel cmdline passed via fw_cfg / SMBIOS OEM strings. Without them the install proceeds but kexec into the installed UKI fails silently and the UEFI firmware falls back to its default boot entry — which is the same Talos installer image on the virtual CD or disk, restarting the loop.

How to check

# Read the fw_cfg cmdline that pivirtd wrote for the VM
sudo cat /var/lib/pivirt/vms/talos-worker-4/run/fwcfg-io.systemd.stub.kernel-cmdline-extra

Expected output must include slab_nomerge pti=on:

talos.config=http://169.254.169.254/talos/config talos.platform=metal console=ttyS0,115200 slab_nomerge pti=on

Fix — Ensure TalosBoot cmdline is set in config.yaml

The VM config.yaml must contain or the internal default must include the KSPP params. As of the July 2026 fix, pivirtd’s internal default cmdline is:

talos.config=http://169.254.169.254/talos/config talos.platform=metal console=ttyS0,115200 slab_nomerge pti=on

You can override per-VM by setting talos_boot.cmdline in config.yaml:

talos_boot:
  cmdline: "talos.config=http://169.254.169.254/talos/config talos.platform=metal console=ttyS0,115200 slab_nomerge pti=on"

After editing, restart the VM:

sudo pivirtctl vm stop -f talos-worker-4
sudo pivirtctl vm start talos-worker-4

---

Root Cause B — VM has no network during first boot (installer cannot fetch config)

If the Talos installer cannot reach http://169.254.169.254/talos/config, installation completes but the applied config is empty. The node reboots into a partially-configured state and loops.

This manifests as an earlier symptom: DHCP failures before the install gets to kexec. See 01-vm-no-ip.md to resolve networking first, then wipe the disk and retry.

---

Root Cause C — NVRAM boot order is stale / corrupted

OVMF NVRAM (nvram.fd) stores the UEFI boot order. If the NVRAM was copied from a previous VM or a partially-installed system, the boot order may not include the newly installed UKI entry and falls through to the installer.

Fix

sudo pivirtctl vm stop -f talos-worker-4

# Reset NVRAM to factory defaults
sudo cp /usr/share/OVMF/OVMF_VARS.fd /var/lib/pivirt/vms/talos-worker-4/nvram.fd

# Also wipe disk so installation starts fresh
sudo rm /var/lib/pivirt/vms/talos-worker-4/disks/system.raw
sudo qemu-img create -f raw /var/lib/pivirt/vms/talos-worker-4/disks/system.raw 10G

sudo pivirtctl vm start talos-worker-4

---

Root Cause D — Missing STATE volume / no such attribute: system_disk

Console shows:

[talos] volume status  phase="failed -> failed"  error="error evaluating disk locator: no such attribute(s): system_disk"

This means Talos installed but cannot find its own STATE partition. The most common cause is that the disk was presented as virtio-blk but Talos is looking for a SATA or NVMe device selector. On QEMU q35 with pivirtd, always use bus: virtio and dev: vda.

How to check

sudo cat /var/lib/pivirt/vms/talos-worker-4/config.yaml | grep -A5 'disks'

Expected:

disks:
  - deviceType: disk
    driver:
      name: qemu
      type: raw
    path: /var/lib/pivirt/vms/talos-worker-4/disks/system.raw
    target:
      bus: virtio
      dev: vda

If bus is sata or ide, change it to virtio, wipe the disk, and reinstall.

---

Watching the Boot in Real-Time

# Stream the serial console (Ctrl+C to stop)
sudo tail -f /var/lib/pivirt/vms/talos-worker-4/run/console.log

# In another terminal: watch for assigned address (success indicator)
sudo tail -f /var/lib/pivirt/vms/talos-worker-4/run/console.log \
  | grep -E 'assigned address|kexec|volume status|STATE'

---

Related Guides

• VM Gets No DHCP / IP Address
• QEMU Disk Write Lock
• Metadata Server Returns 404