Vulnerability Response

Vulnerability Response

Tracking and mitigating known kernel vulnerabilities across the fleet.

Architecture

Kernel module blocking lives in modules/security.nix under the permanent hardening.kernel block (enabled by default on all hosts). Two layers:

LayerMechanismScope
boot.blacklistedKernelModulesKernel cmdline modprobe.blacklist=Prevents auto-load on hardware probe
boot.extraModprobeConfiginstall <mod> /bin/falseBlocks ALL loads including explicit modprobe

Both are needed: blacklistedKernelModules is advisory (some kernel paths bypass it), while install ... /bin/false makes modprobe itself refuse.

Blocked Modules

ModuleReason
dccp, sctp, tipcRare/unused transport protocols
rds, rds_tcp, rds_rdmaRDS protocol (page-cache write LPE); see below
algif_aead, algif_skcipherAF_ALG AEAD — kernel crypto surface
xfrm_algo, xfrm_user, xfrm4_tunnel, xfrm6_tunnelIPsec XFRM framework
esp4, esp6, esp4_offload, esp6_offloadESP packet transformation
rxrpcAF_RXRPC — rarely used

Adding a Temporary CVE Mitigation

When a new vulnerability appears that needs fleet-wide mitigation before upstream patches land:

  1. Add modules to the blacklist and extraModprobeConfig in modules/security.nix under the hardening.kernel block.

  2. Gate with a new option if the mitigation is destructive or should be toggleable per-host:

    options.modules.security.hardening = {
  # ... existing options ...
  blockNewVuln = mkBoolOpt true;
};

  3. Document the CVE/exploit here with references.

  4. Deploy to all affected hosts.

  5. Remove when patched — once all hosts run a fixed kernel, delete the module entries and any temporary option.

Historical Mitigations

RDS Page-Cache Write LPE — mitigated 2026-05-20

FieldDetail
ClassLocal privilege escalation via page-cache overwrite
VectorRDS protocol (Reliable Datagram Sockets) — error path mishandles user-provided memory pages, allowing overwrite of arbitrary readable file page cache
ImpactUnprivileged user → root (effectively write to any readable file)
AffectedAll stable kernels at time of disclosure (fix not yet in stable)
Fix committorvalds/linux@e17492979319
Researcherv12-security
Referenceshttps://www.openwall.com/lists/oss-security/2026/05/19/6, https://github.com/v12-security/pocs/tree/main/pintheft

Mitigated via both layers:

boot.blacklistedKernelModules = [ "rds" "rds_tcp" "rds_rdma" ];
boot.extraModprobeConfig = ''
  install rds /run/current-system/sw/bin/false
  install rds_tcp /run/current-system/sw/bin/false
  install rds_rdma /run/current-system/sw/bin/false
'';

Remove when all fleet hosts run a kernel with e17492979319 backported (likely 6.6.x, 6.12.x stable releases).

Dirty Frag (xfrm-ESP + RxRPC Page-Cache Write LPE) — mitigated 2026-04

FieldDetail
ClassLocal privilege escalation via page-cache write
Vectorsxfrm-ESP (since Linux 4.10), RxRPC (since Linux 6.4)
ImpactUnprivileged user → root
Affected kernels4.10 through current (xfrm-ESP), 6.4+ (RxRPC)
Fix commitf4c50a4034e6 (“xfrm: fix page-cache write in xfrm-esp”)
ResearcherHyunwoo Kim (@v4bel)
Referenceshttps://github.com/V4bel/dirtyfrag, https://lore.kernel.org/all/afKV2zGR6rrelPC7@v4bel

Originally tracked under modules.security.vulnerabilities.dirtyFrag (removed 2026-05). Now part of the permanent hardening block as general AEAD/ESP/XFRM attack surface reduction.

Verification

# Blacklist took effect (check kernel cmdline):
cat /proc/cmdline | tr ' ' '\n' | grep modprobe

# Modules not loaded:
lsmod | grep -E 'algif|xfrm|esp|rxrpc'

# modprobe blocked (should return non-zero):
modprobe esp4; echo $?   # → 1

hey check Integration

boot.blacklistedKernelModules generates modprobe.blacklist=... on the kernel command line. hey check flake validates the config but not runtime state — verify on the target host after deploy.