I’ve started limiting each VM to 1 VCPU (e.g., xl vcpu-set sys-firewall 1 to take effect now, qvm-prefs sys-firewall vcpus 1 for next restart of the VM) in the hope of mitigating concurrency-related vulnerabilities in software that spins up one thread per VCPU. I wonder whether other people have tried this already and encountered any issues with it.
Which vulnerabilities are you referring to?
For example, maybe this would have mitigated CVE-2026-98432. But the point is broader than any particular bug; the point is that it’s common for software to (1) spin up one thread per OS-announced core and (2) have bugs with multiple threads that can’t occur when there’s only one thread.