Merge pull request 'fix CVE-2026-43500' (#38) from develop into release-25.11

Reviewed-on: #38
2026-05-09 09:02:10 +02:00 · 2026-05-09 09:02:10 +02:00 · b9736a5f50
commit b9736a5f50
parent a43fa6440b 997c4a98dc
1 changed files with 12 additions and 0 deletions
--- a/modules/nixos/common/boot.nix
+++ b/modules/nixos/common/boot.nix
@ -5,4 +5,16 @@
  boot.kernelPackages = lib.mkIf (lib.versionOlder pkgs.linux.version "6.18.22") (
    lib.mkDefault pkgs.linuxPackages_6_18
  );
+
+  # fix CVE-2026-43500
+  boot.extraModprobeConfig = ''
+    install esp4 ${pkgs.coreutils}/bin/false
+    install esp6 ${pkgs.coreutils}/bin/false
+    install rxrpc ${pkgs.coreutils}/bin/false
+  '';
+  boot.blacklistedKernelModules = [
+    "esp4"
+    "esp6"
+    "rxrpc"
+  ];
 }