kernel defenses