fix(matic): pin kernel to 6.17 for Falcon sensor compatibility - #1898
Conversation
Falcon sensor 7.31.0-18410 reports CS_PREVENTION_MISSING on kernel 6.18.33 - the prevention kernel module fails to load. Pin to 6.17 until a newer sensor build adds 6.18 support.
|
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
Disabled knowledge base sources:
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe kernel version pin for the matic NixOS host is downgraded from 6.18 to 6.17 to address Falcon sensor and RFM hardware compatibility constraints. The comment describing this constraint is updated to match the new kernel selection. ChangesKernel Version Pin
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Poem
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Mesa DescriptionTL;DRPins the Linux kernel to version 6.17 to resolve CrowdStrike Falcon sensor compatibility issues ( What changed?
Test plan
Description generated by Mesa. Update settings |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request downgrades the pinned kernel version in the Nix configuration from 6.18 to 6.17 to address compatibility issues with the CrowdStrike Falcon sensor. However, the reviewer correctly points out that Linux kernel versions 6.17 and 6.18 do not exist yet, which will cause a Nix evaluation failure. It is recommended to use a valid, existing kernel package attribute from Nixpkgs.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| # Pin kernel: Falcon sensor 7.31.0 lacks kernel module for 6.18+, RFM on 6.19 | ||
| boot.kernelPackages = pkgs.linuxPackages_6_17; |
There was a problem hiding this comment.
The Linux kernel has not yet released versions 6.17 or 6.18 (the current stable releases are in the 6.12/6.13 range). Consequently, pkgs.linuxPackages_6_17 (and the previous pkgs.linuxPackages_6_18) do not exist in Nixpkgs, which will cause a Nix evaluation failure (attribute 'linuxPackages_6_17' missing).
Please use a valid, existing kernel package attribute from Nixpkgs (such as pkgs.linuxPackages_6_6 or pkgs.linuxPackages_6_12 depending on compatibility requirements). Note that the Framework AMD AI 300 series hardware typically requires at least kernel 6.11+ for proper graphics and Wi-Fi support.
![mesa-dot-dev[bot]](https://avatars.githubusercontent.com/in/1050077?s=60&v=4){kind=small}
There was a problem hiding this comment.
Performed full review of 391dec1...e4aefe8
Analysis
• Fleet inconsistency risk: Intentional kernel downgrade on one host creates infrastructure heterogeneity. Without a fleet-wide audit, other hosts running the same Falcon EDR version may have latent compatibility issues that go undetected.
• Missing removal criteria and tracking: The updated comment lacks vendor reference, issue tracking, ownership, review deadline, or explicit removal trigger. This creates maintainability debt and risks the downgrade becoming permanent technical debt.
• Unvalidated security tradeoff: While kernel 6.17 improves endpoint protection, the change assumes ongoing security backports in the NixOS channel. Verify kernel 6.17's security support status before merging.
• Incomplete compatibility documentation: No Falcon-kernel compatibility matrix is documented. The fix is host-specific with unclear scope—determine if this pattern should apply to other Falcon-enabled hosts or if this indicates a systemic compatibility gap.
Tip
Help
Slash Commands:
/review- Request a full code review/review latest- Review only changes since the last review/describe- Generate PR description. This will update the PR body or issue comment depending on your configuration/help- Get help with Mesa commands and configuration options
0 files reviewed | 1 comments | Edit Agent Settings • Read Docs
|
|
||
| # Pin kernel to 6.18 for CrowdStrike Falcon compatibility (RFM on 6.19) | ||
| boot.kernelPackages = pkgs.linuxPackages_6_18; | ||
| # Pin kernel: Falcon sensor 7.31.0 lacks kernel module for 6.18+, RFM on 6.19 |
There was a problem hiding this comment.
The updated comment is clearer, but consider adding more tracking context to prevent this pin from becoming permanent technical debt. Suggest including: (1) a link to vendor documentation or support case, (2) an explicit review date or owner, and (3) removal criteria (e.g., "remove when Falcon ≥7.32 supports kernel 6.18+"). This ensures the workaround has a clear lifecycle and doesn't silently persist after the underlying issue is resolved.
Agent: 🏛 Architecture •
Prompt for Agent
Task: Address review feedback left on GitHub.
Repository: shunkakinoki/dotfiles#1898
File: named-hosts/matic/default.nix#L55
Action: Open this file location in your editor, inspect the highlighted code, and resolve the issue described below.
Feedback:
The updated comment is clearer, but consider adding more tracking context to prevent this pin from becoming permanent technical debt. Suggest including: (1) a link to vendor documentation or support case, (2) an explicit review date or owner, and (3) removal criteria (e.g., "remove when Falcon ≥7.32 supports kernel 6.18+"). This ensures the workaround has a clear lifecycle and doesn't silently persist after the underlying issue is resolved.
![indent-zero[bot]](https://avatars.githubusercontent.com/in/1426746?s=60&v=4){kind=small}
| # Pin kernel to 6.18 for CrowdStrike Falcon compatibility (RFM on 6.19) | ||
| boot.kernelPackages = pkgs.linuxPackages_6_18; | ||
| # Pin kernel: Falcon sensor 7.31.0 lacks kernel module for 6.18+, RFM on 6.19 | ||
| boot.kernelPackages = pkgs.linuxPackages_6_17; |
There was a problem hiding this comment.
linuxPackages_6_17 no longer exists in the pinned nixpkgs — eval will throw.
pkgs here comes from hosts/nixos/default.nix (pkgs = import inputs.nixpkgs { ... }), and inputs.nixpkgs.follows = "nixpkgs-unstable" per flake.nix, locked at rev e9a7635a57597d9754eccebdfc7045e6c8600e6b.
In that rev:
pkgs/top-level/aliases.nix:linuxPackages_6_17 = linuxKernel.packages.linux_6_17;pkgs/top-level/linux-kernels.nix:packages.linux_6_17 = throw "linux 6.17 was removed because it reached its end of life upstream"; # Added 2025-12-22(and the underlyingkernels.linux_6_17is also a throw).
So as soon as boot.kernelPackages is forced, nixos-rebuild switch on matic will fail with linux 6.17 was removed because it has reached its end of life upstream, which defeats the purpose of the pin.
The only recent kernels available in this nixpkgs are linuxPackages_6_18 (default) and linuxPackages_7_0 (latest); 6.15/6.16/6.17/6.19 are all EOL throws.
Options:
- Add a separate nixpkgs input pinned to a rev that still has
linuxPackages_6_17and import the kernel from that one (e.g. via a tiny overlay or by exposing a secondpkgsinstance inhosts/nixos/default.nix). - Stay on
linuxPackages_6_18and apply a Falcon-side mitigation (sensor build/version, prevention policy, etc.) until a sensor build supports 6.18+. - Move forward to
linuxPackages_7_0if Falcon happens to work there.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 1 file
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="named-hosts/matic/default.nix">
<violation number="1" location="named-hosts/matic/default.nix:56">
P0: `pkgs.linuxPackages_6_17` was removed from nixpkgs in December 2025 (EOL upstream). This attribute now throws an evaluation error: `"linux 6.17 was removed because it reached its end of life upstream"`. Currently available LTS/stable kernel packages are `linuxPackages_6_6`, `linuxPackages_6_12`, and `linuxPackages_6_18`. Since the PR comment states Falcon sensor 7.31.0 lacks a module for 6.18+, you may need to pin to `linuxPackages_6_12` or upgrade the Falcon sensor to a version that supports 6.18.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| # Pin kernel to 6.18 for CrowdStrike Falcon compatibility (RFM on 6.19) | ||
| boot.kernelPackages = pkgs.linuxPackages_6_18; | ||
| # Pin kernel: Falcon sensor 7.31.0 lacks kernel module for 6.18+, RFM on 6.19 | ||
| boot.kernelPackages = pkgs.linuxPackages_6_17; |
There was a problem hiding this comment.
P0: pkgs.linuxPackages_6_17 was removed from nixpkgs in December 2025 (EOL upstream). This attribute now throws an evaluation error: "linux 6.17 was removed because it reached its end of life upstream". Currently available LTS/stable kernel packages are linuxPackages_6_6, linuxPackages_6_12, and linuxPackages_6_18. Since the PR comment states Falcon sensor 7.31.0 lacks a module for 6.18+, you may need to pin to linuxPackages_6_12 or upgrade the Falcon sensor to a version that supports 6.18.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At named-hosts/matic/default.nix, line 56:
<comment>`pkgs.linuxPackages_6_17` was removed from nixpkgs in December 2025 (EOL upstream). This attribute now throws an evaluation error: `"linux 6.17 was removed because it reached its end of life upstream"`. Currently available LTS/stable kernel packages are `linuxPackages_6_6`, `linuxPackages_6_12`, and `linuxPackages_6_18`. Since the PR comment states Falcon sensor 7.31.0 lacks a module for 6.18+, you may need to pin to `linuxPackages_6_12` or upgrade the Falcon sensor to a version that supports 6.18.</comment>
<file context>
@@ -52,8 +52,8 @@ import ../../hosts/nixos {
- # Pin kernel to 6.18 for CrowdStrike Falcon compatibility (RFM on 6.19)
- boot.kernelPackages = pkgs.linuxPackages_6_18;
+ # Pin kernel: Falcon sensor 7.31.0 lacks kernel module for 6.18+, RFM on 6.19
+ boot.kernelPackages = pkgs.linuxPackages_6_17;
# Filesystem hardening
</file context>
| boot.kernelPackages = pkgs.linuxPackages_6_17; | |
| boot.kernelPackages = pkgs.linuxPackages_6_12; |
Root cause: CrowdStrike cloud pushed an OTA update from build 18410 to 19004, but falcon-init.sh rsync'd the old 18410 binaries back on boot, clobbering the update. The running 19004 sensor then failed to exec helper binaries (falcon-fxpredict) with ENOENT, causing CS_PREVENTION_MISSING. The init script now compares installed vs packaged build numbers and skips the rsync when the installed version is newer. Also reverts the kernel pin from 6.17 back to 6.18 (#1898 was a misdiagnosis).
1 participant
Summary
linuxPackages_6_18tolinuxPackages_6_17to resolveCS_PREVENTION_MISSINGon Falcon sensor 7.31.0-18410Test plan
sudo nixos-rebuild switchand rebootsudo systemctl status falcon-sensorshows activesudo /opt/CrowdStrike/falconctl -g --rfm-stateshows not in RFMSummary by cubic
Pin the matic host kernel to
linuxPackages_6_17to keep CrowdStrike Falcon prevention active. Sensor 7.31.0-18410 fails to load its module on 6.18.33, causing CS_PREVENTION_MISSING.sudo nixos-rebuild switchthen reboot.sudo systemctl status falcon-sensoris active./opt/CrowdStrike/falconctl -g --rfm-state.Written for commit e4aefe8. Summary will update on new commits.