Not Affected — disabled features

Overview: A row is Not Affected on the kernel you boot only when that option is unset, because only then is the vulnerable code absent. On the 6.18.9-hs kernel that ships, CONFIG_BPF_SYSCALL is unset, so there is no eBPF program to load. The proof for any row is the pin config — the build configuration published for that kernel — because the guest file /boot/config-6.18.9-hs is a stub and a grep of it proves nothing. See Evidence Status.

Compiled-in residuals and write-ups: Compiled-in CVEs. Method: Kernel Security Transparency.

Where an option below is unset, that subsystem is absent and the group is Not Affected without a per-CVE review. Where that option is set on the kernel you boot, the row stays on the patch date and carries no Not Affected badge.

An option set to =m (built as a module) stays on the patch date. Early in every Root Lock kernel boot, heartsuite-kernel-latch.service sets kernel.modules_disabled=1, and after that a later modprobe stays refused. Not Affected remains the badge for an unset option only. Code in a module that did load, and code built in with =y, stays in the running kernel. Scanners still match the pin config. See How to read the backstop sections.

Where a CVE in this section achieves root privilege, Lockdown provides the same backstop described in CVE-2026-31431. An attacker who already has root cannot persist or edit the allowlist, because the allowlist files are immutable and the kernel refuses the write.

BPF Syscall Interface

Status: Not Affected
Config gate: CONFIG_BPF_SYSCALL not set
CVEs covered: CVE-2021-20194

The BPF syscall interface is the kernel entry point through which user-space programs load and run BPF programs in kernel context. CVE-2021-20194 describes a heap overflow in the BPF verifier reachable by a local user who submits a crafted BPF program, gaining elevated privilege.

CONFIG_BPF_SYSCALL is not set on 5.19.6 and is not set on the 6.18.9-hs kernel that ships, so there is no eBPF program to load (bpf() returns ENOSYS). This row covers the syscall entry point.

Netfilter nftables

Status: Stays on the patch date (CONFIG_NF_TABLES=m).
CVEs covered: CVE-2023-32233, CVE-2023-0179

nftables is the in-kernel packet classification and filtering framework. CVE-2023-32233 describes a use-after-free in anonymous set handling reachable via crafted netlink messages by a local user with CAP_NET_ADMIN. CVE-2023-0179 describes a stack-based buffer overflow in the nftables netlink implementation reachable from a user namespace.

Network Traffic Control Schedulers

Status: Split by option on 6.18.9-hs
Config gate: CONFIG_NET_SCH_QFQ=m on 6.18.9-hs. CONFIG_NET_CLS_TCINDEX is not in this config.
CVEs covered: CVE-2023-31436, CVE-2023-1829, CVE-2023-1281

These CVEs cover two traffic control components: the QFQ (Quick Fair Queueing) scheduler and the TCINDEX traffic control filter. CVE-2023-31436 describes an out-of-bounds write in the QFQ scheduler reachable via tc qdisc add. CVE-2023-1829 and CVE-2023-1281 both describe use-after-free conditions in the TCINDEX filter reachable by a local user with CAP_NET_ADMIN.

CONFIG_NET_CLS_TCINDEX is not in this config, so CVE-2023-1829 and CVE-2023-1281 stay on the Not Affected row.

Bluetooth Stack

Status: Stays on the patch date (CONFIG_BT=m).
Config gate: CONFIG_BT=m on 6.18.9-hs
CVEs covered: CVE-2022-42896, CVE-2022-45934, CVE-2022-3564, CVE-2022-3640, CVE-2023-1989, and 3 additional CVEs in this group

These CVEs cover the kernel Bluetooth stack across the L2CAP, HCI, and RFCOMM layers. They include type confusion, use-after-free, and memory corruption conditions reachable by an attacker in proximity to the target device over Bluetooth, or by a local user with socket access to the Bluetooth subsystem.

Protocol Families: TLS, RDS, ROSE, MCTP, and AF_RXRPC

Status: Split by option on 6.18.9-hs
Config gate: CONFIG_TLS=m, CONFIG_RDS=m, CONFIG_ROSE=m, and CONFIG_AF_RXRPC=m on 6.18.9-hs. CONFIG_MCTP is not set.
CVEs covered: CVE-2023-28466, CVE-2023-1078, CVE-2022-2961, CVE-2022-3977, CVE-2023-2006

These CVEs cover five distinct socket protocol families, each gated by its own config option:

• TLS (CVE-2023-28466) — a race condition in the in-kernel TLS record layer reachable via a socket configured with SO_TLS_TX
• RDS (CVE-2023-1078) — a heap out-of-bounds write in the Reliable Datagram Sockets implementation
• ROSE (CVE-2022-2961) — a race condition in the X.25 ROSE packet radio protocol socket layer
• MCTP (CVE-2022-3977) — a use-after-free in the Management Component Transport Protocol socket layer
• AF_RXRPC (CVE-2023-2006) — a race condition in the RxRPC remote procedure call socket family

CONFIG_MCTP is not set, so CVE-2022-3977 is Not Affected.

NFS Server

Status: Stays on the patch date (CONFIG_NFSD=m).
Config gate: CONFIG_NFSD=m on 6.18.9-hs
CVEs covered: CVE-2022-43945, CVE-2022-4379, CVE-2023-1652

The kernel NFS server (nfsd) allows a Linux host to export filesystems to NFS clients over the network. CVE-2022-43945 describes a buffer overflow in the NFSv4 XDR decoder reachable from the network. CVE-2022-4379 describes a use-after-free in the NFSv4.1 setclientid_confirm handler. CVE-2023-1652 describes a use-after-free in the NFSv4 lease handling.

Filesystem Drivers

Status: Split by option on 6.18.9-hs
Config gate: CONFIG_NTFS3_FS=m, CONFIG_JFS_FS=m, and CONFIG_NILFS2_FS=m on 6.18.9-hs. CONFIG_NTFS_FS is not set.
CVEs covered: CVE-2022-48423, CVE-2022-48424, CVE-2022-48425, CVE-2023-26544, CVE-2023-26506, CVE-2023-26507, CVE-2023-2124, CVE-2020-27815, CVE-2022-2978

These CVEs cover four filesystem drivers. The CVEs include out-of-bounds reads and writes and use-after-free conditions across the NTFS3 driver (CONFIG_NTFS3_FS), the legacy NTFS driver (CONFIG_NTFS_FS), JFS (CONFIG_JFS_FS), and NILFS2 (CONFIG_NILFS2_FS). Several are triggerable by mounting a crafted filesystem image. CONFIG_XFS_FS is documented separately, and those CVEs stay on the patch date.

Legacy NTFS (CONFIG_NTFS_FS) is not set.

Hardware-Specific and Virtualization Drivers

Status: Split by option on 6.18.9-hs
Config gate: CONFIG_FPGA is not set and the GRU symbol is absent from the 6.18.9-hs kernel. DVB Core and KVM Intel stay on the patch date (see Kvm).
CVEs covered: CVE-2022-45884, CVE-2022-45885, CVE-2022-45886, CVE-2022-45919, CVE-2022-3424, CVE-2023-26242, CVE-2022-2196

• DVB Core (CVE-2022-45884, CVE-2022-45885, CVE-2022-45886, CVE-2022-45919) — these stay on the patch date.
• SGI GRU (CVE-2022-3424) — the GRU symbol is absent from the 6.18.9-hs kernel, so this CVE is Not Affected there.
• Intel FPGA (CVE-2023-26242) — CONFIG_FPGA is not set, so this CVE is Not Affected on 6.18.9-hs.
• KVM Intel (CVE-2022-2196) — covered under Kvm. Root Lock runs as a guest.

USB Network Adapter and SMB Server

Status: Split by option on 6.18.9-hs
Config gate: CONFIG_SMB_SERVER=m on 6.18.9-hs. CONFIG_USB_NET_RNDIS_WLAN is not in this config.
CVEs covered: CVE-2023-23559, CVE-2023-0210

• USB RNDIS WLAN (CVE-2023-23559) — an integer overflow in the RNDIS wireless USB adapter driver triggerable by a physically present attacker with a crafted USB device
• SMB Server / ksmbd (CVE-2023-0210) — a heap out-of-bounds read in ksmbd, the in-kernel SMB server, reachable from the network without authentication via a crafted SMB2 NEGOTIATE request

CONFIG_USB_NET_RNDIS_WLAN is not in this config, so CVE-2023-23559 stays on the Not Affected row.

Ntfs3 Fs

Status: Stays on the patch date (CONFIG_NTFS3_FS=m). Config gate: CONFIG_NTFS3_FS=m on 6.18.9-hs CVEs covered: CVE-2022-48502

Traffic Control: cls_flower

Status: Stays on the patch date (CONFIG_NET_CLS_FLOWER=m). Config gate: CONFIG_NET_CLS_FLOWER=m on 6.18.9-hs CVEs covered: CVE-2023-35788

CAN Bus

Status: Stays on the patch date (CONFIG_CAN=m). Config gate: CONFIG_CAN=m on 6.18.9-hs CVEs covered: CVE-2023-3090, CVE-2023-3389, CVE-2023-3609, CVE-2023-3611, CVE-2023-3776, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208, CVE-2023-4622, CVE-2023-4921, CVE-2023-5717, CVE-2023-46813, CVE-2023-6931, CVE-2023-6932, CVE-2023-6546, CVE-2023-6270, CVE-2024-25744, CVE-2023-52438, CVE-2023-52439, CVE-2023-52474, CVE-2023-52501

Smb Server

Status: Stays on the patch date (CONFIG_SMB_SERVER=m). Config gate: CONFIG_SMB_SERVER=m on 6.18.9-hs CVEs covered: CVE-2023-32250, CVE-2023-32254, CVE-2023-32247, CVE-2023-32248, CVE-2023-32252, CVE-2023-32257, CVE-2023-32258, CVE-2024-22705, CVE-2023-52441, CVE-2024-26592, CVE-2024-26594, CVE-2023-52480

HFS Filesystem

Status: Stays on the patch date (CONFIG_HFS_FS=m). Config gate: CONFIG_HFS_FS=m on 6.18.9-hs CVEs covered: CVE-2023-4623

Ceph Filesystem

Status: Stays on the patch date (CONFIG_CEPH_FS=m). Config gate: CONFIG_CEPH_FS=m on 6.18.9-hs CVEs covered: CVE-2023-44466

NVMe Driver

Status: Stays on the patch date (CONFIG_NVME_CORE=y). Config gate: CONFIG_NVME_CORE=y on 6.18.9-hs CVEs covered: CVE-2023-5178, CVE-2023-6356, CVE-2023-6536

CIFS/SMB Client

Status: Stays on the patch date (CONFIG_CIFS=m). Config gate: CONFIG_CIFS=m on 6.18.9-hs CVEs covered: CVE-2023-1194, CVE-2023-52434, CVE-2023-52440

ATM Protocol

Status: Stays on the patch date (CONFIG_ATM=m). Config gate: CONFIG_ATM=m on 6.18.9-hs CVEs covered: CVE-2023-51780

Rose

Status: Stays on the patch date (CONFIG_ROSE=m). Config gate: CONFIG_ROSE=m on 6.18.9-hs CVEs covered: CVE-2023-51782

Tls

Status: Stays on the patch date (CONFIG_TLS=m). Config gate: CONFIG_TLS=m on 6.18.9-hs CVEs covered: CVE-2024-0646

DCCP Protocol

Status: Not Affected Config gate: CONFIG_IP_DCCP not set CVEs covered: CVE-2023-39197

CONFIG_IP_DCCP is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

AMD GPU (amdgpu)

Status: Stays on the patch date (CONFIG_DRM_AMDGPU=m). Config gate: CONFIG_DRM_AMDGPU=m on 6.18.9-hs CVEs covered: CVE-2023-51042

F2FS Filesystem

Status: Stays on the patch date (CONFIG_F2FS_FS=m). Config gate: CONFIG_F2FS_FS=m on 6.18.9-hs CVEs covered: CVE-2023-52436, CVE-2023-52444

Atheros Wireless Driver

Status: Not Affected Config gate: CONFIG_ATH not set CVEs covered: CVE-2023-52464

CONFIG_ATH is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Mctp

Status: Not Affected Config gate: CONFIG_MCTP not set CVEs covered: CVE-2023-52483

CONFIG_MCTP is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

FUSE Filesystem

Status: Stays on the patch date (CONFIG_FUSE_FS=y). Config gate: CONFIG_FUSE_FS=y on 6.18.9-hs CVEs covered: CVE-2023-52504

NFC

Status: Stays on the patch date (CONFIG_NFC=m). Config gate: CONFIG_NFC=m on 6.18.9-hs CVEs covered: CVE-2023-52507

Renesas Ethernet AVB Driver

Status: Not Affected Config gate: CONFIG_RAVB not set CVEs covered: CVE-2023-52509

CONFIG_RAVB is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

IEEE 802.15.4 (WPAN)

Status: Stays on the patch date (CONFIG_IEEE802154=m). Config gate: CONFIG_IEEE802154=m on 6.18.9-hs CVEs covered: CVE-2023-52510

InfiniBand / RDMA

Status: Stays on the patch date (CONFIG_INFINIBAND=m). Config gate: CONFIG_INFINIBAND=m on 6.18.9-hs CVEs covered: CVE-2023-52515, CVE-2024-26872

Spi Sun6I

Status: Not Affected Config gate: CONFIG_SPI_SUN6I not set CVEs covered: CVE-2023-52517

CONFIG_SPI_SUN6I is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Intel WiFi (iwlwifi)

Status: Stays on the patch date (CONFIG_IWLWIFI=m). Config gate: CONFIG_IWLWIFI=m on 6.18.9-hs CVEs covered: CVE-2023-52531, CVE-2024-26610

Security Tomoyo

Status: Stays on the patch date (CONFIG_SECURITY_TOMOYO=y). Config gate: CONFIG_SECURITY_TOMOYO=y on 6.18.9-hs CVEs covered: CVE-2024-26622

Drm Msm

Status: Not Affected Config gate: CONFIG_DRM_MSM not set CVEs covered: CVE-2023-52586

CONFIG_DRM_MSM is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

S390

Status: Not Affected Config gate: CONFIG_S390 not set CVEs covered: CVE-2023-52598, CVE-2024-26957

CONFIG_S390 is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Jfs Fs

Status: Stays on the patch date (CONFIG_JFS_FS=m). Config gate: CONFIG_JFS_FS=m on 6.18.9-hs CVEs covered: CVE-2023-52599, CVE-2023-52600, CVE-2023-52603, CVE-2023-52604

Llc

Status: Stays on the patch date (CONFIG_LLC=m). Config gate: CONFIG_LLC=m on 6.18.9-hs CVEs covered: CVE-2024-26625

Mhi Bus

Status: Stays on the patch date (CONFIG_MHI_BUS=m). Config gate: CONFIG_MHI_BUS=m on 6.18.9-hs CVEs covered: CVE-2023-52494

Ip Tunnel

Status: Not Affected Config gate: CONFIG_IP_TUNNEL not set CVEs covered: CVE-2024-26665

CONFIG_IP_TUNNEL is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Afs Fs

Status: Stays on the patch date (CONFIG_AFS_FS=m). Config gate: CONFIG_AFS_FS=m on 6.18.9-hs CVEs covered: CVE-2024-26736

Traffic Control: act_mirred

Status: Stays on the patch date (CONFIG_NET_ACT_MIRRED=m). Config gate: CONFIG_NET_ACT_MIRRED=m on 6.18.9-hs CVEs covered: CVE-2024-26739

Usb Cdns3

Status: Not Affected Config gate: CONFIG_USB_CDNS3 not set CVEs covered: CVE-2024-26748, CVE-2024-26749

CONFIG_USB_CDNS3 is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Crypto Dev Virtio

Status: Stays on the patch date (CONFIG_CRYPTO_DEV_VIRTIO=m). Config gate: CONFIG_CRYPTO_DEV_VIRTIO=m on 6.18.9-hs CVEs covered: CVE-2024-26753

Gtp

Status: Stays on the patch date (CONFIG_GTP=m). Config gate: CONFIG_GTP=m on 6.18.9-hs CVEs covered: CVE-2024-26754, CVE-2024-26793

Dm Crypt

Status: Stays on the patch date (CONFIG_DM_CRYPT=m). Config gate: CONFIG_DM_CRYPT=m on 6.18.9-hs CVEs covered: CVE-2024-26763

MPTCP

Status: Stays on the patch date (CONFIG_MPTCP=y). Config gate: CONFIG_MPTCP=y on 6.18.9-hs CVEs covered: CVE-2024-26782

Btrfs Filesystem

Status: Stays on the patch date (CONFIG_BTRFS_FS=m). Config gate: CONFIG_BTRFS_FS=m on 6.18.9-hs CVEs covered: CVE-2024-26791, CVE-2024-26944, CVE-2024-35849, CVE-2024-35949, CVE-2024-39496, CVE-2024-42314, CVE-2024-50217, CVE-2024-56581, CVE-2024-56582, CVE-2024-56759, CVE-2024-57896, CVE-2025-39738, CVE-2025-39759, CVE-2022-50300

Thinkpad Lmi

Status: Stays on the patch date (CONFIG_THINKPAD_LMI=m). Config gate: CONFIG_THINKPAD_LMI=m on 6.18.9-hs CVEs covered: CVE-2024-26836

Sparx5 Switch

Status: Not Affected Config gate: CONFIG_SPARX5_SWITCH not set CVEs covered: CVE-2024-26856

CONFIG_SPARX5_SWITCH is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Rds

Status: Stays on the patch date (CONFIG_RDS=m). Config gate: CONFIG_RDS=m on 6.18.9-hs CVEs covered: CVE-2024-26865, CVE-2022-48637, CVE-2024-27024

TUN/TAP Driver

Status: Stays on the patch date (CONFIG_TUN=m). Config gate: CONFIG_TUN=m on 6.18.9-hs CVEs covered: CVE-2024-26882

Mlxbf I2C

Status: Not Affected Config gate: CONFIG_MLXBF_I2C not set CVEs covered: CVE-2022-48632

CONFIG_MLXBF_I2C is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

ARM64 Architecture

Status: Not Affected Config gate: CONFIG_ARM64 not set CVEs covered: CVE-2022-48657, CVE-2024-26989

CONFIG_ARM64 is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Nilfs2 Fs

Status: Stays on the patch date (CONFIG_NILFS2_FS=m). Config gate: CONFIG_NILFS2_FS=m on 6.18.9-hs CVEs covered: CVE-2024-26955, CVE-2024-26956, CVE-2024-26981

Common Clk Qcom

Status: Not Affected Config gate: CONFIG_COMMON_CLK_QCOM not set CVEs covered: CVE-2024-26965

CONFIG_COMMON_CLK_QCOM is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

USB Gadget

Status: Stays on the patch date (CONFIG_USB_GADGET=m). Config gate: CONFIG_USB_GADGET=m on 6.18.9-hs CVEs covered: CVE-2024-26996

Nouveau (NVIDIA open-source)

Status: Stays on the patch date (CONFIG_DRM_NOUVEAU=m). Config gate: CONFIG_DRM_NOUVEAU=m on 6.18.9-hs CVEs covered: CVE-2024-27008

Dvb Core

Status: Stays on the patch date (CONFIG_DVB_CORE=m). Config gate: CONFIG_DVB_CORE=m on 6.18.9-hs CVEs covered: CVE-2024-27075

Peci

Status: Not Affected Config gate: CONFIG_PECI not set CVEs covered: CVE-2022-48670

CONFIG_PECI is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Of

Status: Not Affected Config gate: CONFIG_OF not set CVEs covered: CVE-2022-48672

CONFIG_OF is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

EROFS Filesystem

Status: Stays on the patch date (CONFIG_EROFS_FS=m). Config gate: CONFIG_EROFS_FS=m on 6.18.9-hs CVEs covered: CVE-2022-48674

Open vSwitch

Status: Stays on the patch date (CONFIG_OPENVSWITCH=m). Config gate: CONFIG_OPENVSWITCH=m on 6.18.9-hs CVEs covered: CVE-2024-27395

FireWire

Status: Stays on the patch date (CONFIG_FIREWIRE=m). Config gate: CONFIG_FIREWIRE=m on 6.18.9-hs CVEs covered: CVE-2024-27401

Kvm

Status: Stays on the patch date (CONFIG_KVM=m, CONFIG_KVM_INTEL=m). Config gate: CONFIG_KVM=m on 6.18.9-hs CVEs covered: CVE-2024-35791, CVE-2022-2196

Hosting virtual machines on this kernel is not a supported product role. Root Lock runs as a guest. These CVEs stay on the patch date, including the Intel nested-VMX case CVE-2022-2196.

Aquantia Atlantic Driver

Status: Not Affected Config gate: CONFIG_ATLANTIC not set CVEs covered: CVE-2023-52664

CONFIG_ATLANTIC is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Mellanox mlx5 Driver

Status: Stays on the patch date (CONFIG_MLX5_CORE=m). Config gate: CONFIG_MLX5_CORE=m on 6.18.9-hs CVEs covered: CVE-2023-52667

AX.25 / Ham Radio

Status: Stays on the patch date (CONFIG_AX25=m). Config gate: CONFIG_AX25=m on 6.18.9-hs CVEs covered: CVE-2024-35887

Dma Direct Remap

Status: Not Affected Config gate: CONFIG_DMA_DIRECT_REMAP not set CVEs covered: CVE-2024-35939

CONFIG_DMA_DIRECT_REMAP is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Fb

Status: Stays on the patch date (CONFIG_FB=y). Config gate: CONFIG_FB=y on 6.18.9-hs CVEs covered: CVE-2023-52731

GFS2 Shared Filesystem

Status: Stays on the patch date (CONFIG_GFS2_FS=m). Config gate: CONFIG_GFS2_FS=m on 6.18.9-hs CVEs covered: CVE-2023-52760

GSPCA USB Webcam Driver

Status: Not Affected Config gate: CONFIG_USB_GSPCA_CORE not set CVEs covered: CVE-2023-52764

CONFIG_USB_GSPCA_CORE is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

SMC (RDMA over Converged Ethernet)

Status: Not Affected Config gate: CONFIG_SMC not set CVEs covered: CVE-2023-52775

CONFIG_SMC is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

IPVLAN Driver

Status: Stays on the patch date (CONFIG_IPVLAN=m). Config gate: CONFIG_IPVLAN=m on 6.18.9-hs CVEs covered: CVE-2023-52796

HiSilicon HNS3 Driver

Status: Not Affected Config gate: CONFIG_HNS3 not set CVEs covered: CVE-2023-52807

CONFIG_HNS3 is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

KVM AMD

Status: Stays on the patch date (CONFIG_KVM_AMD=m). Config gate: CONFIG_KVM_AMD=m on 6.18.9-hs CVEs covered: CVE-2023-52816

Network Block Device (NBD)

Status: Stays on the patch date (CONFIG_BLK_DEV_NBD=m). Config gate: CONFIG_BLK_DEV_NBD=m on 6.18.9-hs CVEs covered: CVE-2023-52837

Synaptics RMI4 Driver

Status: Stays on the patch date (CONFIG_RMI4_CORE=m). Config gate: CONFIG_RMI4_CORE=m on 6.18.9-hs CVEs covered: CVE-2023-52840

Bt848 Video Capture Driver

Status: Stays on the patch date (CONFIG_VIDEO_BT848=m). Config gate: CONFIG_VIDEO_BT848=m on 6.18.9-hs CVEs covered: CVE-2023-52847

Hw Perf Events Hisi

Status: Not Affected Config gate: CONFIG_HW_PERF_EVENTS_HISI not set CVEs covered: CVE-2023-52859

CONFIG_HW_PERF_EVENTS_HISI is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

WMI Driver

Status: Not Affected Config gate: CONFIG_WMI not set CVEs covered: CVE-2023-52864

CONFIG_WMI is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

AMD Radeon GPU

Status: Stays on the patch date (CONFIG_DRM_RADEON=m). Config gate: CONFIG_DRM_RADEON=m on 6.18.9-hs CVEs covered: CVE-2023-52867

Parallel Port Device

Status: Stays on the patch date (CONFIG_PPDEV=m). Config gate: CONFIG_PPDEV=m on 6.18.9-hs CVEs covered: CVE-2024-36015

TIPC Protocol

Status: Stays on the patch date (CONFIG_TIPC=m). Config gate: CONFIG_TIPC=m on 6.18.9-hs CVEs covered: CVE-2024-36886

GPIO Library

Status: Stays on the patch date (CONFIG_GPIOLIB=y). Config gate: CONFIG_GPIOLIB=y on 6.18.9-hs CVEs covered: CVE-2024-36898, CVE-2024-36899

Pin Controller Subsystem

Status: Stays on the patch date (CONFIG_PINCTRL=y). Config gate: CONFIG_PINCTRL=y on 6.18.9-hs CVEs covered: CVE-2024-36940

VMware SVGA (vmwgfx)

Status: Stays on the patch date (CONFIG_DRM_VMWGFX=m). Config gate: CONFIG_DRM_VMWGFX=m on 6.18.9-hs CVEs covered: CVE-2024-36960

Traffic Control: sch_multiq

Status: Stays on the patch date (CONFIG_NET_SCH_MULTIQ=m). Config gate: CONFIG_NET_SCH_MULTIQ=m on 6.18.9-hs CVEs covered: CVE-2024-36978

IMA (Integrity Measurement Architecture)

Status: Stays on the patch date (CONFIG_IMA=y). Config gate: CONFIG_IMA=y on 6.18.9-hs CVEs covered: CVE-2024-38667

Boot-path protection in Root Lock seals the kernel image directory and /boot under Lockdown with chattr +i, so those files cannot be modified while the Root Lock kernel is running. CONFIG_KEXEC_FILE is not set. Secure Boot is not enforced or verified by Root Lock; if Secure Boot is required, it must be configured at the firmware and bootloader level independently.

PowerPC Architecture

Status: Not Affected Config gate: CONFIG_PPC not set CVEs covered: CVE-2024-40974

CONFIG_PPC is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Xfs Fs

Status: Stays on the patch date (CONFIG_XFS_FS=m). Config gate: CONFIG_XFS_FS=m on 6.18.9-hs CVEs covered: CVE-2024-41013, CVE-2024-41014

HFS+ Filesystem

Status: Stays on the patch date (CONFIG_HFSPLUS_FS=m). Config gate: CONFIG_HFSPLUS_FS=m on 6.18.9-hs CVEs covered: CVE-2024-41059

ISDN

Status: Stays on the patch date (CONFIG_ISDN=y). Config gate: CONFIG_ISDN=y on 6.18.9-hs CVEs covered: CVE-2024-42280

Platform X86

Status: Not Affected Config gate: CONFIG_PLATFORM_X86 not set CVEs covered: CVE-2024-46859

CONFIG_PLATFORM_X86 is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

OCFS2 Filesystem

Status: Stays on the patch date (CONFIG_OCFS2_FS=m). Config gate: CONFIG_OCFS2_FS=m on 6.18.9-hs CVEs covered: CVE-2024-47670

Xen Hypervisor

Status: Stays on the patch date (CONFIG_XEN=y). Config gate: CONFIG_XEN=y on 6.18.9-hs CVEs covered: CVE-2024-49936

PPP

Status: Stays on the patch date (CONFIG_PPP=m). Config gate: CONFIG_PPP=m on 6.18.9-hs CVEs covered: CVE-2024-50033, CVE-2024-50035

QCOM RmNet Driver

Status: Not Affected Config gate: CONFIG_RMNET not set CVEs covered: CVE-2024-50128

CONFIG_RMNET is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

UDF Filesystem

Status: Stays on the patch date (CONFIG_UDF_FS=m). Config gate: CONFIG_UDF_FS=m on 6.18.9-hs CVEs covered: CVE-2024-50143

LoongArch Architecture

Status: Not Affected Config gate: CONFIG_LOONGARCH not set CVEs covered: CVE-2024-56628

CONFIG_LOONGARCH is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Realtek WiFi Driver

Status: Stays on the patch date (CONFIG_RTLWIFI=m). Config gate: CONFIG_RTLWIFI=m on 6.18.9-hs CVEs covered: CVE-2024-58072

Broadcom WiFi Driver

Status: Stays on the patch date (CONFIG_BRCMFMAC=m). Config gate: CONFIG_BRCMFMAC=m on 6.18.9-hs CVEs covered: CVE-2022-49740

MemStick Driver

Status: Stays on the patch date (CONFIG_MEMSTICK=m). Config gate: CONFIG_MEMSTICK=m on 6.18.9-hs CVEs covered: CVE-2025-22020

SCTP Protocol

Status: Stays on the patch date (CONFIG_IP_SCTP=m). Config gate: CONFIG_IP_SCTP=m on 6.18.9-hs CVEs covered: CVE-2025-23142

Ntfs Fs

Status: Not Affected Config gate: CONFIG_NTFS_FS not set CVEs covered: CVE-2022-49763

CONFIG_NTFS_FS is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Net Sch Qfq

Status: Stays on the patch date (CONFIG_NET_SCH_QFQ=m). Config gate: CONFIG_NET_SCH_QFQ=m on 6.18.9-hs CVEs covered: CVE-2025-37913

Af Rxrpc

Status: Stays on the patch date (CONFIG_AF_RXRPC=m). Config gate: CONFIG_AF_RXRPC=m on 6.18.9-hs CVEs covered: CVE-2023-53218

Marvell WiFi Driver

Status: Stays on the patch date (CONFIG_MWIFIEX=m). Config gate: CONFIG_MWIFIEX=m on 6.18.9-hs CVEs covered: CVE-2025-39891

Microchip WILC1000 WiFi Driver

Status: Not Affected Config gate: CONFIG_WILC1000 not set CVEs covered: CVE-2025-39952

CONFIG_WILC1000 is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Traffic Control: cls_u32

Status: Stays on the patch date (CONFIG_NET_CLS_U32=m). Config gate: CONFIG_NET_CLS_U32=m on 6.18.9-hs CVEs covered: CVE-2026-23204

SAA7134 Media Driver

Status: Stays on the patch date (CONFIG_VIDEO_SAA7134=m). Config gate: CONFIG_VIDEO_SAA7134=m on 6.18.9-hs CVEs covered: CVE-2023-35823

DM1105 DVB Driver

Status: Not Affected Config gate: CONFIG_VIDEO_DM1105 not set CVEs covered: CVE-2023-35824

CONFIG_VIDEO_DM1105 is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Allwinner Cedrus Video Codec

Status: Not Affected Config gate: CONFIG_VIDEO_SUNXI_CEDRUS not set CVEs covered: CVE-2023-35826

CONFIG_VIDEO_SUNXI_CEDRUS is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Renesas USB3 Driver

Status: Not Affected Config gate: CONFIG_USB_RENESAS_USBHS3 not set CVEs covered: CVE-2023-35828

CONFIG_USB_RENESAS_USBHS3 is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Rockchip Video Decoder

Status: Not Affected Config gate: CONFIG_VIDEO_RKVDEC not set CVEs covered: CVE-2023-35829

CONFIG_VIDEO_RKVDEC is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Intel IGB Ethernet Driver

Status: Stays on the patch date (CONFIG_IGB=m). Config gate: CONFIG_IGB=m on 6.18.9-hs CVEs covered: CVE-2023-45871

AppleTalk Protocol

Status: Stays on the patch date (CONFIG_ATALK=m). Config gate: CONFIG_ATALK=m on 6.18.9-hs CVEs covered: CVE-2023-51781

Hauppauge pvrusb2 Driver

Status: Stays on the patch date (CONFIG_VIDEO_PVRUSB2=m). Config gate: CONFIG_VIDEO_PVRUSB2=m on 6.18.9-hs CVEs covered: CVE-2023-52445

PWM Subsystem

Status: Stays on the patch date (CONFIG_PWM=y). Config gate: CONFIG_PWM=y on 6.18.9-hs CVEs covered: CVE-2024-26599

Griffin PowerMate Driver

Status: Stays on the patch date (CONFIG_INPUT_POWERMATE=m). Config gate: CONFIG_INPUT_POWERMATE=m on 6.18.9-hs CVEs covered: CVE-2023-52475

TEE Subsystem

Status: Stays on the patch date (CONFIG_TEE=m). Config gate: CONFIG_TEE=m on 6.18.9-hs CVEs covered: CVE-2023-52503

Bonding

Status: Stays on the patch date (CONFIG_BONDING=m). Config gate: CONFIG_BONDING=m on 6.18.9-hs CVEs covered: CVE-2024-39487, CVE-2026-23099

Vmware Vmci

Status: Stays on the patch date (CONFIG_VMWARE_VMCI=m). Config gate: CONFIG_VMWARE_VMCI=m on 6.18.9-hs CVEs covered: CVE-2024-39499, CVE-2024-46738, CVE-2025-38403

Wwan

Status: Stays on the patch date (CONFIG_WWAN=m). Config gate: CONFIG_WWAN=m on 6.18.9-hs CVEs covered: CVE-2024-40939

Cachefiles

Status: Stays on the patch date (CONFIG_CACHEFILES=m). Config gate: CONFIG_CACHEFILES=m on 6.18.9-hs CVEs covered: CVE-2024-41050, CVE-2024-41057, CVE-2024-41074

Snd Soc

Status: Stays on the patch date (CONFIG_SND_SOC=m). Config gate: CONFIG_SND_SOC=m on 6.18.9-hs CVEs covered: CVE-2024-41069, CVE-2022-50325

Iio

Status: Stays on the patch date (CONFIG_IIO=m). Config gate: CONFIG_IIO=m on 6.18.9-hs CVEs covered: CVE-2024-42086, CVE-2024-57906, CVE-2024-57907, CVE-2024-57908, CVE-2024-57910, CVE-2024-57911, CVE-2024-57912, CVE-2022-49792, CVE-2025-38485

Vhost Vsock

Status: Stays on the patch date (CONFIG_VHOST_VSOCK=m). Config gate: CONFIG_VHOST_VSOCK=m on 6.18.9-hs CVEs covered: CVE-2024-43873

Net Fou

Status: Stays on the patch date (CONFIG_NET_FOU=m). Config gate: CONFIG_NET_FOU=m on 6.18.9-hs CVEs covered: CVE-2024-44940, CVE-2026-23083

Parisc

Status: Not Affected Config gate: CONFIG_PARISC not set CVEs covered: CVE-2024-44949, CVE-2022-50518

CONFIG_PARISC is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Net Sch Netem

Status: Stays on the patch date (CONFIG_NET_SCH_NETEM=m). Config gate: CONFIG_NET_SCH_NETEM=m on 6.18.9-hs CVEs covered: CVE-2024-46800

Uml

Status: Not Affected Config gate: CONFIG_UML not set CVEs covered: CVE-2024-46844

CONFIG_UML is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Spi Nxp Flexspi

Status: Not Affected Config gate: CONFIG_SPI_NXP_FLEXSPI not set CVEs covered: CVE-2024-46853

CONFIG_SPI_NXP_FLEXSPI is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Vdpa

Status: Stays on the patch date (CONFIG_VDPA=m). Config gate: CONFIG_VDPA=m on 6.18.9-hs CVEs covered: CVE-2024-47748, CVE-2024-53126, CVE-2023-53082, CVE-2023-53543

Usb Serial

Status: Stays on the patch date (CONFIG_USB_SERIAL=m). Config gate: CONFIG_USB_SERIAL=m on 6.18.9-hs CVEs covered: CVE-2024-50267

Usb Musb Hdrc

Status: Not Affected Config gate: CONFIG_USB_MUSB_HDRC not set CVEs covered: CVE-2024-50269

CONFIG_USB_MUSB_HDRC is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Superh

Status: Not Affected Config gate: CONFIG_SUPERH not set CVEs covered: CVE-2024-53165

CONFIG_SUPERH is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Spi Mpc52Xx

Status: Not Affected Config gate: CONFIG_SPI_MPC52xx not set CVEs covered: CVE-2024-50051

CONFIG_SPI_MPC52xx is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Pktgen

Status: Not Affected Config gate: CONFIG_PKTGEN not set CVEs covered: CVE-2025-21680

CONFIG_PKTGEN is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Orangefs Fs

Status: Stays on the patch date (CONFIG_ORANGEFS_FS=m). Config gate: CONFIG_ORANGEFS_FS=m on 6.18.9-hs CVEs covered: CVE-2025-21782

Geneve

Status: Stays on the patch date (CONFIG_GENEVE=m). Config gate: CONFIG_GENEVE=m on 6.18.9-hs CVEs covered: CVE-2025-21858

Slimbus

Status: Stays on the patch date (CONFIG_SLIMBUS=m). Config gate: CONFIG_SLIMBUS=m on 6.18.9-hs CVEs covered: CVE-2025-21914

Udmabuf

Status: Stays on the patch date (CONFIG_UDMABUF=y). Config gate: CONFIG_UDMABUF=y on 6.18.9-hs CVEs covered: CVE-2025-37803

Mcb

Status: Not Affected Config gate: CONFIG_MCB not set CVEs covered: CVE-2025-37817

CONFIG_MCB is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Staging

Status: Stays on the patch date (CONFIG_STAGING=y). Config gate: CONFIG_STAGING=y on 6.18.9-hs CVEs covered: CVE-2022-49956, CVE-2023-53554

Coresight

Status: Not Affected Config gate: CONFIG_CORESIGHT not set CVEs covered: CVE-2025-38131

CONFIG_CORESIGHT is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Ipv6 Seg6 Lwtunnel

Status: Stays on the patch date (CONFIG_IPV6_SEG6_LWTUNNEL=y). Config gate: CONFIG_IPV6_SEG6_LWTUNNEL=y on 6.18.9-hs CVEs covered: CVE-2025-38476

Comedi

Status: Stays on the patch date (CONFIG_COMEDI=m). Config gate: CONFIG_COMEDI=m on 6.18.9-hs CVEs covered: CVE-2025-38482, CVE-2025-38483, CVE-2025-38529, CVE-2025-38530, CVE-2025-39685, CVE-2025-39686

Nubus

Status: Not Affected Config gate: CONFIG_NUBUS not set CVEs covered: CVE-2023-53217

CONFIG_NUBUS is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Xdp Sockets

Status: Not Affected Config gate: CONFIG_XDP_SOCKETS not set CVEs covered: CVE-2023-53426

CONFIG_XDP_SOCKETS is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Ptp 1588 Clock Ocp

Status: Stays on the patch date (CONFIG_PTP_1588_CLOCK_OCP=m). Config gate: CONFIG_PTP_1588_CLOCK_OCP=m on 6.18.9-hs CVEs covered: CVE-2025-39859

Trace Buf

Status: Not Affected Config gate: CONFIG_TRACE_BUF not set CVEs covered: CVE-2023-53587

CONFIG_TRACE_BUF is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Dlm

Status: Stays on the patch date (CONFIG_DLM=m). Config gate: CONFIG_DLM=m on 6.18.9-hs CVEs covered: CVE-2023-53629

Net Team

Status: Stays on the patch date (CONFIG_NET_TEAM=m). Config gate: CONFIG_NET_TEAM=m on 6.18.9-hs CVEs covered: CVE-2025-71091

Macvlan

Status: Stays on the patch date (CONFIG_MACVLAN=m). Config gate: CONFIG_MACVLAN=m on 6.18.9-hs CVEs covered: CVE-2026-23001, CVE-2026-23209

Netfilter OS fingerprint

Status: Stays on the patch date (CONFIG_NETFILTER_NETLINK_OSF=m). Config gate: CONFIG_NETFILTER_NETLINK_OSF=m on 6.18.9-hs CVEs covered: CVE-2026-23397

HackRF

Status: Stays on the patch date (CONFIG_USB_HACKRF=m). Config gate: CONFIG_USB_HACKRF=m on 6.18.9-hs CVEs covered: CVE-2026-31576

Empia EM28xx video

Status: Stays on the patch date (CONFIG_VIDEO_EM28XX_V4L2=m). Config gate: CONFIG_VIDEO_EM28XX_V4L2=m on 6.18.9-hs CVEs covered: CVE-2026-31583

Security Apparmor

Status: Stays on the patch date (CONFIG_SECURITY_APPARMOR=y). Config gate: CONFIG_SECURITY_APPARMOR=y on 6.18.9-hs CVEs covered: CVE-2026-23408

Rcu Nocb Cpu

Status: Stays on the patch date (CONFIG_RCU_NOCB_CPU=y). Config gate: CONFIG_RCU_NOCB_CPU=y on 6.18.9-hs CVEs covered: CVE-2024-35929, CVE-2025-38704

Debug Mutexes

Status: Not Affected Config gate: CONFIG_DEBUG_MUTEXES not set CVEs covered: CVE-2023-52836

CONFIG_DEBUG_MUTEXES is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Stm

Status: Stays on the patch date (CONFIG_STM=m). Config gate: CONFIG_STM=m on 6.18.9-hs CVEs covered: CVE-2024-38627

Greybus

Status: Not Affected Config gate: CONFIG_GREYBUS not set CVEs covered: CVE-2024-39495

CONFIG_GREYBUS is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Ionic

Status: Stays on the patch date (CONFIG_IONIC=m). Config gate: CONFIG_IONIC=m on 6.18.9-hs CVEs covered: CVE-2024-39502

Crypto Dev Hisi Sec2

Status: Not Affected Config gate: CONFIG_CRYPTO_DEV_HISI_SEC2 not set CVEs covered: CVE-2024-42147, CVE-2024-47730

CONFIG_CRYPTO_DEV_HISI_SEC2 is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Bna

Status: Stays on the patch date (CONFIG_BNA=m). Config gate: CONFIG_BNA=m on 6.18.9-hs CVEs covered: CVE-2024-43839

Drm Aspeed Gfx

Status: Not Affected Config gate: CONFIG_DRM_ASPEED_GFX not set CVEs covered: CVE-2023-52916

CONFIG_DRM_ASPEED_GFX is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Pci Kirin

Status: Not Affected Config gate: CONFIG_PCI_KIRIN not set CVEs covered: CVE-2024-47751

CONFIG_PCI_KIRIN is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Drm Stm

Status: Not Affected Config gate: CONFIG_DRM_STM not set CVEs covered: CVE-2024-49992

CONFIG_DRM_STM is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Hi Gmac

Status: Not Affected Config gate: CONFIG_HI_GMAC not set CVEs covered: CVE-2022-48960, CVE-2022-48962

CONFIG_HI_GMAC is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Hsr

Status: Stays on the patch date (CONFIG_HSR=m). Config gate: CONFIG_HSR=m on 6.18.9-hs CVEs covered: CVE-2022-49015

Typec

Status: Stays on the patch date (CONFIG_TYPEC=m). Config gate: CONFIG_TYPEC=m on 6.18.9-hs CVEs covered: CVE-2024-50150

Mse102X

Status: Not Affected Config gate: CONFIG_MSE102X not set CVEs covered: CVE-2024-50276

CONFIG_MSE102X is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Video S5P Jpeg

Status: Not Affected Config gate: CONFIG_VIDEO_S5P_JPEG not set CVEs covered: CVE-2024-53061

CONFIG_VIDEO_S5P_JPEG is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Arm Scmi Protocol

Status: Not Affected Config gate: CONFIG_ARM_SCMI_PROTOCOL not set CVEs covered: CVE-2024-53068

CONFIG_ARM_SCMI_PROTOCOL is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Intel Xe GPU Driver

Status: Stays on the patch date (CONFIG_DRM_XE=m). Config gate: CONFIG_DRM_XE=m on 6.18.9-hs CVEs covered: CVE-2024-53098

Hyperv Vsockets

Status: Not Affected Config gate: CONFIG_HYPERV_VSOCKETS not set CVEs covered: CVE-2024-53103

CONFIG_HYPERV_VSOCKETS is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Usb Lan78Xx

Status: Stays on the patch date (CONFIG_USB_LAN78XX=m). Config gate: CONFIG_USB_LAN78XX=m on 6.18.9-hs CVEs covered: CVE-2024-53213

Drm Xlnx

Status: Not Affected Config gate: CONFIG_DRM_XLNX not set CVEs covered: CVE-2024-56538

CONFIG_DRM_XLNX is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.

Usb Net Cdcether

Status: Stays on the patch date (CONFIG_USB_NET_CDCETHER=m). Config gate: CONFIG_USB_NET_CDCETHER=m on 6.18.9-hs CVEs covered: CVE-2025-38153

Md Raid10

Status: Stays on the patch date (CONFIG_MD_RAID10=m). Config gate: CONFIG_MD_RAID10=m on 6.18.9-hs CVEs covered: CVE-2023-53357

Video Adv748X

Status: Not Affected Config gate: CONFIG_VIDEO_ADV748X not set CVEs covered: CVE-2025-71136

CONFIG_VIDEO_ADV748X is not compiled into the Root Lock kernel. There is no reachable code path for any CVE in this group.