fix(kernel): resolve CIS unused module findings - #18697
Merged
Tobias Brick (tobiasb-ms) merged 1 commit intoSep 3, 2026
Merged
Conversation
Copilot started reviewing on behalf of
Tobias Brick (tobiasb-ms)
September 2, 2026 20:32
View session
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The post-rebase 1.3 build inputs require fresh build and smoke/CIS validation.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Removes unused kernel modules to reduce attack surface and satisfy CIS requirements.
Changes:
- Disables CRAMFS, freevxfs, HFS/HFS+, FireWire, and NOSY.
- Bumps the kernel release to
6.18.45-1.3. - Refreshes rendered configs and lock fingerprint.
File summaries
| File | Description |
|---|---|
base/comps/kernel/kernel.spec |
Bumps release and changelog. |
base/comps/kernel/6.18-x86_64-azl.config |
Disables targeted x86_64 modules. |
base/comps/kernel/6.18-aarch64-azl.config |
Disables targeted aarch64 modules. |
specs/k/kernel/kernel.spec |
Updates rendered kernel spec. |
specs/k/kernel/6.18-x86_64-azl.config |
Updates rendered x86_64 config. |
specs/k/kernel/6.18-aarch64-azl.config |
Updates rendered aarch64 config. |
locks/kernel.lock |
Refreshes the input fingerprint. |
Review details
- Files reviewed: 6/7 changed files
- Comments generated: 1
- Review effort level: Balanced
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Contributor
Author
|
/azp run |
|
Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions. |
Tobias Brick (tobiasb-ms)
marked this pull request as ready for review
September 2, 2026 20:41
Tobias Brick (tobiasb-ms)
force-pushed
the
tobiasb-ms/cis-disable-unused-kernel-modules
branch
from
September 2, 2026 22:40
b5fb3e1 to
40d6f71
Compare
Copilot started reviewing on behalf of
Tobias Brick (tobiasb-ms)
September 2, 2026 22:40
View session
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The aarch64 output lacks the mandatory installation and smoke-test validation.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 7/8 changed files
- Comments generated: 1
- Review effort level: Balanced
Rachel Menge (rlmenge)
approved these changes
Sep 2, 2026
Disable unsupported kernel modules on x86_64 and aarch64 to resolve these CIS Level 1 findings: - Ensure cramfs kernel module is not available (AB#22846) - Ensure freevxfs kernel module is not available (AB#22847) - Ensure hfs kernel module is not available (AB#22848) - Ensure hfsplus kernel module is not available (AB#22849) - Ensure firewire-core kernel module is not available (AB#22850) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Tobias Brick (tobiasb-ms)
force-pushed
the
tobiasb-ms/cis-disable-unused-kernel-modules
branch
from
September 2, 2026 22:55
40d6f71 to
daa8c0c
Compare
Copilot started reviewing on behalf of
Tobias Brick (tobiasb-ms)
September 2, 2026 22:55
View session
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The policy entries match both architecture configs, and the release, lock, rendered outputs, and validation are consistent.
Review details
- Files reviewed: 7/8 changed files
- Comments generated: 0 new
- Review effort level: Balanced
Lynsey Rydberg (corvus-callidus)
approved these changes
Sep 2, 2026
Contributor
Author
|
/azp run |
|
Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions. |
Tobias Brick (tobiasb-ms)
deleted the
tobiasb-ms/cis-disable-unused-kernel-modules
branch
September 3, 2026 16:47
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Rationale
These modules are not part of the expected Azure Linux server workload surface, and compiling them out removes unused kernel attack surface while satisfying the CIS requirement that they not be available. Unlike a modprobe deny-list, this also prevents privileged software from bypassing policy by loading the module file directly.
The existing distribution evidence supports removal:
This also eliminates an x86_64 CIS-CAT applicability trap: AZL4 previously disabled
CONFIG_FIREWIREbut retainedCONFIG_FIREWIRE_NOSY=m. CIS-CAT treatednosy.kounderdrivers/firewireas evidence that the unrelated FireWire core module was available.Validation
After incorporating the latest 4.0 kernel changes, the kernel was rebuilt successfully for x86_64 and aarch64. Both shipped kernel configs were inspected, and the x86_64 build was installed on AZL4 nightly
vm-base4.0.2026082802and tested:Related work items