Notably, this pulls in the dirtycow fix from upstream (but I've been unable to execute the POC exploits on grsec kernels without that fix ...)