It depends on what will be fixed with the hotfix. For example, if you want to install a hotfix to fix a vulnerablity that applies to how the F5 handles HTTP::redirect or HTTP::respond commands, then you will only need to install this on the vCMP guests, because the vCMP host will not handle such traffic. If a hotfix will fix a memory issue, than it could be relevant to both the vCMP host and vCMP guests.
While F5 recommends that you configure your vCMP host to run the same BIG-IP version as the latest version used by any of its vCMP guests, it should be possible to run a vCMP guest with a newer version than the vCMP host. So a vCMP guest may run a version that needs a hotfix, while the vCMP host doesn't, or vice versa.
