our testing points at the new reserved memory for kernel handoff (KHO) being a likely culprit - could you try booting with `kho=off` added to the kernel commandline?
if you manage to reproduce it again, please post the state of ZFS datasets and snapshots on both nodes. do you have HA enabled and were there any failover actions on that guest? or did you do a manual failover by moving the config file from one node to another?
1. proxmox-secure-boot is just a meta package pulling in the secure boot related packages, it is not required to enable/use secure boot
2. without any information about what the actual issue was, it will be hard to diagnose this further
3. updating Grub does not really do anything other than...
could you try an upstream mainline kernel (warning - no ZFS!)? if it also fails there, please report it upstream... it's possible this device requires a quirk on the kernel side.
we do not publish a PSA for every kernel CVE, there are too many (e.g., there have been 45 for KVM alone in the past month, and there might be more fixes that are already rolled out that do not yet have a CVE assigned publicly).
the fix is in Proxmox kernels starting with pve-kernel-7.0.14-25-pve
edit: as is often the case these days - the fix was picked before it got assigned a CVE (2026-10-17 vs 2016-10-23), which is why the CVE is not included in the git or package changelogs..