versions: Update Cloud Hypervisor to v51.2

What could be improved?

Kata currently uses Cloud Hypervisor v51.1. The version is defined in versions.yaml and is also the version shipped with Kata 4.2.0.

v51.1 is affected by CVE-2026-45782 / GHSA-f47p-p25q-83rh, a use-after-free in the virtio-block async I/O completion path (cloud-hypervisor/cloud-hypervisor#8220).

The affected range is v21.0 through v51.1. The fix was released on 2026-05-14 in v51.2 and v52.0.

The guest drives the I/O for every block device Kata attaches through Cloud Hypervisor. This affects any deployment using the CLH runtime.

How can it be improved?

Bump assets.hypervisor.cloud_hypervisor.version to v51.2 and update the hypervisor version table in docs/design/virtualization.md.

v51.2 is a point release on top of v51.1. It contains the security fix, additional virtio-net hardening, and some lint cleanups (12 commits).

The OpenAPI definition is identical between v51.1 and v51.2, so there is no need to regenerate the Go client under src/runtime/virtcontainers/pkg/cloud-hypervisor or change the runtime-rs api_client pin. The x86_64 build features (mshv,tdx) are unchanged as well.

Additional Information

• Release notes: https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v51.2
• Advisory: https://github.com/cloud-hypervisor/cloud-hypervisor/security/advisories/GHSA-f47p-p25q-83rh
• This is separate from #13623 / #13279 (v53.0). Those changes also regenerate the API client and modify the packaging scripts. They can be rebased on top of this change; the only overlap is a single line in versions.yaml.

Before raising this enhancement request

I checked the limitations document. There is nothing concerning the pinned Cloud Hypervisor version.