The grsec patch fails to apply cleanly when combined with the hiddev CVE patch (added in dde259dfb5). To fix this and future problems, we set all our patches explicitly rather than inherit from the base kernel.
dde259dfb5