https://docs.heartsecsuite.com/docs/security/Recent content in Kernel Security Transparency on Root Lock by HeartSuiteHugoenhttps://docs.heartsecsuite.com/docs/security/compiled-in-cves/Mon, 01 Jan 0001 00:00:00 +0000https://docs.heartsecsuite.com/docs/security/compiled-in-cves/<!-- Flat catalog: every entry is an h3 under the page title, so the h1-to-h3 jump is intentional. --> <!-- markdownlint-disable MD001 --> <p><strong>Overview</strong>: Per-CVE write-ups for paths that exist in a Root Lock kernel. A 0.0 score means the trigger is absent on this deployment (hardware, tool, or config). A non-zero score is a live residual.</p> <p>Read <a href="https://docs.heartsecsuite.com/docs/security/#how-to-read-the-backstop-sections">How to read the backstop sections</a> on the Kernel Security Transparency landing before the entries. Compiled-out groups are on <a href="../disabled-features/">Not Affected — Disabled Features</a>.</p>https://docs.heartsecsuite.com/docs/security/disabled-features/Mon, 01 Jan 0001 00:00:00 +0000https://docs.heartsecsuite.com/docs/security/disabled-features/<!-- Flat catalog: every entry is an h3 under the page title, so the h1-to-h3 jump is intentional. --> <!-- markdownlint-disable MD001 --> <p><strong>Overview</strong>: These CVE groups have no reachable code path on the Root Lock kernel because the feature is not compiled in. Confirm a gate with <code>grep CONFIG_&lt;GATE&gt; /boot/config-$(uname -r)</code>.</p> <p>Compiled-in residuals and write-ups: <a href="../compiled-in-cves/">Compiled-in CVEs</a>. Method: <a href="https://docs.heartsecsuite.com/docs/">Kernel Security Transparency</a>.</p> <p>Root Lock is built for production servers, regulated workstations, build infrastructure, and AI agent sandboxes. The kernel does not include subsystems these workloads do not require. Each absent subsystem eliminates the full class of vulnerabilities that subsystem carries, without requiring per-CVE evaluation.</p>