Skip to content

fix(matic): pin kernel to 6.17 for Falcon sensor compatibility #1898

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shunkakinoki merged 1 commit into from
Jun 8, 2026
Merged

fix(matic): pin kernel to 6.17 for Falcon sensor compatibility #1898

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions named-hosts/matic/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,8 +52,8 @@ import ../../hosts/nixos {
"tpm2-device=auto"
];

# Pin kernel to 6.18 for CrowdStrike Falcon compatibility (RFM on 6.19)
boot.kernelPackages = pkgs.linuxPackages_6_18;
# Pin kernel: Falcon sensor 7.31.0 lacks kernel module for 6.18+, RFM on 6.19

@mesa-dot-dev mesa-dot-dev Bot Jun 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Medium

The updated comment is clearer, but consider adding more tracking context to prevent this pin from becoming permanent technical debt. Suggest including: (1) a link to vendor documentation or support case, (2) an explicit review date or owner, and (3) removal criteria (e.g., "remove when Falcon ≥7.32 supports kernel 6.18+"). This ensures the workaround has a clear lifecycle and doesn't silently persist after the underlying issue is resolved.

Agent: 🏛 Architecture • Fix in Cursor • Fix in Claude

Prompt for Agent 
Task: Address review feedback left on GitHub.
Repository: shunkakinoki/dotfiles#1898
File: named-hosts/matic/default.nix#L55
Action: Open this file location in your editor, inspect the highlighted code, and resolve the issue described below.

Feedback:
The updated comment is clearer, but consider adding more tracking context to prevent this pin from becoming permanent technical debt. Suggest including: (1) a link to vendor documentation or support case, (2) an explicit review date or owner, and (3) removal criteria (e.g., "remove when Falcon ≥7.32 supports kernel 6.18+"). This ensures the workaround has a clear lifecycle and doesn't silently persist after the underlying issue is resolved.

boot.kernelPackages = pkgs.linuxPackages_6_17;
Comment on lines +55 to +56

@gemini-code-assist gemini-code-assist Bot Jun 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The Linux kernel has not yet released versions 6.17 or 6.18 (the current stable releases are in the 6.12/6.13 range). Consequently, pkgs.linuxPackages_6_17 (and the previous pkgs.linuxPackages_6_18) do not exist in Nixpkgs, which will cause a Nix evaluation failure (attribute 'linuxPackages_6_17' missing).

Please use a valid, existing kernel package attribute from Nixpkgs (such as pkgs.linuxPackages_6_6 or pkgs.linuxPackages_6_12 depending on compatibility requirements). Note that the Framework AMD AI 300 series hardware typically requires at least kernel 6.11+ for proper graphics and Wi-Fi support.

@indent-zero indent-zero Bot Jun 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

linuxPackages_6_17 no longer exists in the pinned nixpkgs — eval will throw.

pkgs here comes from hosts/nixos/default.nix (pkgs = import inputs.nixpkgs { ... }), and inputs.nixpkgs.follows = "nixpkgs-unstable" per flake.nix, locked at rev e9a7635a57597d9754eccebdfc7045e6c8600e6b.

In that rev:

  • pkgs/top-level/aliases.nix: linuxPackages_6_17 = linuxKernel.packages.linux_6_17;
  • pkgs/top-level/linux-kernels.nix: packages.linux_6_17 = throw "linux 6.17 was removed because it reached its end of life upstream"; # Added 2025-12-22 (and the underlying kernels.linux_6_17 is also a throw).

So as soon as boot.kernelPackages is forced, nixos-rebuild switch on matic will fail with linux 6.17 was removed because it has reached its end of life upstream, which defeats the purpose of the pin.

The only recent kernels available in this nixpkgs are linuxPackages_6_18 (default) and linuxPackages_7_0 (latest); 6.15/6.16/6.17/6.19 are all EOL throws.

Options:

  1. Add a separate nixpkgs input pinned to a rev that still has linuxPackages_6_17 and import the kernel from that one (e.g. via a tiny overlay or by exposing a second pkgs instance in hosts/nixos/default.nix).
  2. Stay on linuxPackages_6_18 and apply a Falcon-side mitigation (sensor build/version, prevention policy, etc.) until a sensor build supports 6.18+.
  3. Move forward to linuxPackages_7_0 if Falcon happens to work there.

@cubic-dev-ai cubic-dev-ai Bot Jun 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P0: pkgs.linuxPackages_6_17 was removed from nixpkgs in December 2025 (EOL upstream). This attribute now throws an evaluation error: "linux 6.17 was removed because it reached its end of life upstream". Currently available LTS/stable kernel packages are linuxPackages_6_6, linuxPackages_6_12, and linuxPackages_6_18. Since the PR comment states Falcon sensor 7.31.0 lacks a module for 6.18+, you may need to pin to linuxPackages_6_12 or upgrade the Falcon sensor to a version that supports 6.18.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At named-hosts/matic/default.nix, line 56:

<comment>`pkgs.linuxPackages_6_17` was removed from nixpkgs in December 2025 (EOL upstream). This attribute now throws an evaluation error: `"linux 6.17 was removed because it reached its end of life upstream"`. Currently available LTS/stable kernel packages are `linuxPackages_6_6`, `linuxPackages_6_12`, and `linuxPackages_6_18`. Since the PR comment states Falcon sensor 7.31.0 lacks a module for 6.18+, you may need to pin to `linuxPackages_6_12` or upgrade the Falcon sensor to a version that supports 6.18.</comment>

<file context>
@@ -52,8 +52,8 @@ import ../../hosts/nixos {
-        # Pin kernel to 6.18 for CrowdStrike Falcon compatibility (RFM on 6.19)
-        boot.kernelPackages = pkgs.linuxPackages_6_18;
+        # Pin kernel: Falcon sensor 7.31.0 lacks kernel module for 6.18+, RFM on 6.19
+        boot.kernelPackages = pkgs.linuxPackages_6_17;
 
         # Filesystem hardening
</file context>
Suggested change
boot.kernelPackages = pkgs.linuxPackages_6_17;
boot.kernelPackages = pkgs.linuxPackages_6_12;


# Filesystem hardening
boot.kernel.sysctl = {
Expand Down
Loading