diff --git a/patches/kernel/README.md b/patches/kernel/README.md
new file mode 100644
index 0000000..5926bb7
--- /dev/null
+++ b/patches/kernel/README.md
@@ -0,0 +1,33 @@
+# Kernel core patches — PF-on-Linux
+
+**Current state: the patch set is EMPTY by design.**
+
+The port is an out-of-tree module (`module/pf.ko`). The only kernel-tree
+prerequisite is a *configured build* of Linux 7.3.4 (`scripts/build-kernel.sh`:
+defconfig + virtio/EXT4 built-in + `modules_prepare`), which touches **no
+source file**.
+
+## Verification that nothing is exported-missing
+
+`modpost` reports **zero undefined symbols** for pf.ko against stock 7.3.4
+(M1, 2026-11-11; tracked in docs/porting-notes.md).  When future milestones
+(M4 divert, M5 pfq qdisc, M6 hardening) hit a non-exported helper, the
+requirement is recorded here as `p1-needs.txt` entries and materialized as:
+
+```
+patches/kernel/0001-<slug>.patch
+patches/kernel/0002-<slug>.patch
+...
+patches/kernel/series          # ordered list consumed by apply-patches.sh
+```
+
+## Rules every patch must satisfy
+
+1. Additive only: `EXPORT_SYMBOL*()` lines or Kconfig/Makefile hooks — never
+   behavior changes to existing code paths.
+2. One logical change per patch; subject lines prefixed `net: export ...` /
+   `pf_port: ...`.
+3. Each patch gets a matching section in `docs/en/patches.md` and
+   `docs/pt-BR/patches.md`: what / why / where / impact / revert.
+4. `scripts/apply-patches.sh <kerneldir>` and `scripts/unpatch.sh <kerneldir>`
+   apply/remove the whole series idempotently.
diff --git a/patches/kernel/series b/patches/kernel/series
new file mode 100644
index 0000000..807ac94
--- /dev/null
+++ b/patches/kernel/series
@@ -0,0 +1 @@
+# empty by design — no core patches required (verified via modpost, M1)
diff --git a/scripts/apply-patches.sh b/scripts/apply-patches.sh
new file mode 100755
index 0000000..887accb
--- /dev/null
+++ b/scripts/apply-patches.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Apply (or verify) the kernel core patch series against a Linux tree.
+# Usage: ./scripts/apply-patches.sh /path/to/linux-7.3.4
+set -euo pipefail
+REPO="$(cd "$(dirname "$0")/.." && pwd)"
+K="${1:?usage: apply-patches.sh <kernel-dir>}"
+SERIES="$REPO/patches/kernel/series"
+
+[ -d "$K" ] || { echo "no kernel dir $K" >&2; exit 1; }
+if [ ! -s "$SERIES" ]; then
+	echo "patch series is empty (none needed) — nothing to apply"
+	# still ensure build prep happened (idempotent hint)
+	[ -f "$K/Module.symvers" ] || echo "note: run scripts/build-kernel.sh first"
+	exit 0
+fi
+applied=0
+while read -r p; do
+	[ -n "$p" ] || continue
+	case "$p" in \#*) continue;; esac
+	f="$REPO/patches/kernel/$p"
+	[ -f "$f" ] || { echo "missing $f" >&2; exit 1; }
+	if git -C "$K" rev-parse >/dev/null 2>&1; then
+		git -C "$K" am -3 --no-gpg-sign "$f" && applied=$((applied+1))
+	else
+		patch -p1 -d "$K" --forward -i "$f" && applied=$((applied+1))
+	fi
+	echo "applied: $p  (see docs/*/patches.md)"
+done < "$SERIES"
+echo "PATCHES_APPLIED=$applied"
diff --git a/scripts/unpatch.sh b/scripts/unpatch.sh
new file mode 100755
index 0000000..ffd5b67
--- /dev/null
+++ b/scripts/unpatch.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Reverse-apply the kernel core patch series.
+# Usage: ./scripts/unpatch.sh /path/to/linux-7.3.4
+set -euo pipefail
+REPO="$(cd "$(dirname "$0")/.." && pwd)"
+K="${1:?usage: unpatch.sh <kernel-dir>}"
+SERIES="$REPO/patches/kernel/series"
+
+[ -d "$K" ] || { echo "no kernel dir $K" >&2; exit 1; }
+if [ ! -s "$SERIES" ]; then
+	echo "patch series is empty — nothing to revert"
+	exit 0
+fi
+reverted=0
+tac "$SERIES" | while read -r p; do
+	[ -n "$p" ] || continue
+	case "$p" in \#*) continue;; esac
+	f="$REPO/patches/kernel/$p"
+	if git -C "$K" rev-parse >/dev/null 2>&1; then
+		git -C "$K" am -3 --reverse --no-gpg-sign "$f" || true
+	else
+		patch -p1 -R -d "$K" --forward -i "$f" || true
+	fi
+	echo "reverted: $p"
+done
+echo "UNPATCH_DONE"