Hardening matrix for kernel 6.18.9
Subject: Root Lock by HeartSuite, fielded 6.18.9-hs (packaging 6.18.9-HeartSuite-3, build #37)
uname -r: 6.18.9-hs
Config SHA-256 (pin payload): 3cd1824742b9a15e9467c774c5f62081f9547f730ad7cd9bce464a7d286a7db9
vmlinuz SHA-256: 1b44fffb9b570497f19f4c68e170602b542bc84bfe9f49d936c123dc59f5db8a
Tool: kernel-hardening-checker commit e870d0141259f875d3d1b54fef49dec7074e4cac, run 2026-08-18
Source file: evidence-pack-6.18.9.txt
Legacy (published): Hardening scores: 5.19.6, evidence-pack-5.19.6.txt
This page measures the fielded #37 pin. It is not a derived unpublished cut.
CONFIG_IO_URING,CONFIG_KEXEC, andCONFIG_KEXEC_FILEare =y. Guest/boot/config-6.18.9-hsis an 11-line RD stub — hash the pin payload config.
Part 1 — Measured comparison
Arch linux-hardened 6.18.16-hardened1 and vanilla 6.18.9 defconfig are era-matched 6.18.x (no 6.18.9-hardened in the Arch archive).
| Config | Source | Kernel | Overall | Attack-surface | Exploit-resistance |
|---|---|---|---|---|---|
| HS 6.18.9-hs #37 | Pin payload config (SHA 3cd18247…) | 6.18.9 | 148/259 (57.1%) | 57/131 (43.5%) | 78/110 (70.9%) |
| Arch linux-hardened 6.18.16 | Packaging tag 6.18.16.hardened1-1 config.x86_64 | 6.18.16-hardened1 | 181/259 (69.9%) | 76/131 (58.0%) | 92/110 (83.6%) |
| Vanilla x86_64 defconfig | make ARCH=x86_64 defconfig on linux-6.18.9 | 6.18.9 | 153/259 (59.1%) | 88/131 (67.2%) | 56/110 (50.9%) |
Reading the table
- Attack-surface = dangerous features disabled. Higher = more things off.
- Exploit-resistance = defensive mitigations against memory bugs. Higher = harder to exploit.
- These axes are largely independent.
- Do not compare these percentages to the 5.19.6 pack (checker
b9b83a0, 132 / 109 item denominators).
What this shows
HS 6.18.9-hs does not lead attack-surface (43.5% vs era-matched Arch 58.0% and vanilla 6.18.9 defconfig 67.2%). Bypass primitives that 5.19.6 compiled out are on here.
HS 6.18.9-hs does sit above vanilla 6.18.9 defconfig on exploit-resistance (70.9% vs 50.9%) and below era-matched Arch 6.18.16 hardened (83.6%).
Bypass-primitive options — measured
| Option | HS 6.18.9-hs #37 | HS 5.19.6 (published pack) |
|---|---|---|
CONFIG_BPF_SYSCALL | =y | =n |
CONFIG_IO_URING | =y | =y |
CONFIG_FUSE_FS | =y | =n |
CONFIG_OVERLAY_FS | =m | =n |
CONFIG_SECURITY_APPARMOR | =y | =n |
CONFIG_SECURITY_TOMOYO | =y | =n |
CONFIG_KEXEC | =y | =y |
CONFIG_KEXEC_FILE | =y | =n |
CONFIG_USER_NS | =y | =n |
CONFIG_MODULE_SIG | =y | =n |
CONFIG_MODULE_SIG_FORCE | =n | =n |
Exploit-resistance mitigations — measured
| Mitigation | HS 6.18.9-hs #37 | Arch lh 6.18.16 |
|---|---|---|
INIT_ON_ALLOC_DEFAULT_ON | =y | =y |
INIT_ON_FREE_DEFAULT_ON | =n | =y |
HARDENED_USERCOPY | =y | =y |
FORTIFY_SOURCE | =y | =y |
SLAB_FREELIST_RANDOM | =y | =y |
KFENCE | =y (sample interval 0) | =y |
RANDSTRUCT_FULL | not found | not compared here |
KSTACK_ERASE | not found | =y |
MODULE_SIG / MODULE_SIG_FORCE | =y / =n | =y / =n |
Part 2 — Qualitative orientation (cross-project)
| Project | Bypass prevention | Exploit resistance | Module footprint | Availability | Primary use case |
|---|---|---|---|---|---|
| HeartSuite 6.18.9-hs #37 | Low–moderate — BPF/FUSE/OVERLAY/AppArmor/TOMOYO/USER_NS/IO_URING/KEXEC present (measured) | Moderate–high — 70.9% self_protection (measured) | 74 loaded / 4190 .ko.xz (Debian 12 guest) | Commercial | Containment via allowlist + Lockdown on a general-purpose 6.18 config |
| HeartSuite 5.19.6 | Very high compile-out (measured) | Low — vanilla baseline | 0 loaded / 9 .ko | Commercial (legacy) | Same product contract; different kernel config |
| Arch linux-hardened 6.18.16 | Moderate | High (83.6% ER) | Hundreds | Free | General-purpose hardened desktop/server |
| grsecurity / PaX | High | Very high | Large | Paid | Maximum exploit resistance |
| CLIP OS (ANSSI) | High | High | ~400 | Public (archived) | Government platform |
| KSPP recommended x86-64 | High (intent) | Very high (intent) | N/A | Public | Industry benchmark |
Part 3 — LSM stack and module count (measured)
| Metric | HS 6.18.9-hs #37 | Source |
|---|---|---|
| Modules loaded at runtime | 74 | Debian 12 guest, 2026-08-18 |
Loadable .ko.xz shipped | 4190 | /lib/modules/6.18.9-hs |
| modules.builtin entries | 198 | same guest |
| SELinux fs | absent (no /sys/fs/selinux) | runtime |
/sys/kernel/security/lsm | lockdown,capability,landlock,yama,apparmor,tomoyo,bpf,ipe,ima,evm | runtime |
| Root Lock activation | dmesg t+4s, monitor ON | runtime |
| Alt-LSMs in config | YAMA, LANDLOCK, LOCKDOWN_LSM, IMA, EVM, APPARMOR, TOMOYO all =y | pin grep |
Part 4 — CPU mitigations (6.18 naming)
| Mitigation | 6.18.x option | HS 6.18.9-hs #37 |
|---|---|---|
| Spectre v1 | CONFIG_MITIGATION_SPECTRE_V1 | =y (checker OK) |
| Spectre v2 | CONFIG_MITIGATION_SPECTRE_V2 | =y (checker OK) |
| Retbleed | CONFIG_MITIGATION_RETBLEED | =y (checker OK) |
Summary
| Dimension | HS 6.18.9-hs #37 | HS 5.19.6 (legacy pack) | Arch lh 6.18.16 |
|---|---|---|---|
| Overall checker | 57.1% | 50.0%† | 69.9% |
| Attack-surface | 43.5% | 68.9%† | 58.0% |
| Exploit-resistance | 70.9% | 28.4%† | 83.6% |
| BPF / FUSE / USER_NS / AppArmor off | No | Yes | No |
| IO_URING / KEXEC off | No | No | KEXEC off on Arch row |
| Runtime modules loaded | 74 | 0 | Not measured |
| Config SHA-256 published | Yes (3cd18247…) | Yes (d67caa6…) | Bundled |
† Different checker commit and item counts — directional only.
For the 5.19.6 dataset see Hardening scores: 5.19.6. Raw 6.18 notes: evidence-pack-6.18.9.txt. Publication status: Evidence Status.
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.