kernel: update PATCHES with a stricter policy