diff --git a/dev-util/scap-driver/files/0.29.3-fix-kmod-build-on-6.4+.patch b/dev-util/scap-driver/files/0.29.3-fix-kmod-build-on-6.4+.patch
new file mode 100644
index 0000000000000..ac0a4aeca285d
--- /dev/null
+++ b/dev-util/scap-driver/files/0.29.3-fix-kmod-build-on-6.4+.patch
@@ -0,0 +1,33 @@
+
+From: https://github.com/falcosecurity/libs/pull/1110
+Bug: https://github.com/falcosecurity/libs/issues/1109
+
+From 394c9d84e64ad9828cdce6cdad5a76c352e252d2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Holger=20Hoffst=C3=A4tte?= <holger@applied-asynchrony.com>
+Date: Fri, 19 May 2023 03:54:40 +0200
+Subject: [PATCH] fix(driver): fixed 6.4 kernel build
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Holger Hoffstätte <holger@applied-asynchrony.com>
+---
+ driver/main.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/driver/main.c b/driver/main.c
+index 380f85c27c..668e45429a 100644
+--- a/driver/main.c
++++ b/driver/main.c
+@@ -2912,7 +2912,11 @@ int scap_init(void)
+ 		goto init_module_err;
+ 	}
+ 
++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 4, 0)
+ 	g_ppm_class = class_create(THIS_MODULE, DRIVER_DEVICE_NAME);
++#else
++	g_ppm_class = class_create(DRIVER_DEVICE_NAME);
++#endif
+ 	if (IS_ERR(g_ppm_class)) {
+ 		pr_err("can't allocate device class\n");
+ 		ret = -EFAULT;
diff --git a/dev-util/scap-driver/scap-driver-0.29.3-r3.ebuild b/dev-util/scap-driver/scap-driver-0.29.3-r3.ebuild
new file mode 100644
index 0000000000000..deb27234ee351
--- /dev/null
+++ b/dev-util/scap-driver/scap-driver-0.29.3-r3.ebuild
@@ -0,0 +1,61 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit cmake linux-mod
+
+DESCRIPTION="Kernel module for dev-util/sysdig"
+HOMEPAGE="https://sysdig.com/"
+
+# The driver is part of falcosecurity/libs, but for versioning reasons we cannot (yet)
+# use semver-released packages; instead we pull in a commit that is used and known
+# to work with sysdig, see sysdig/cmake/modules/falcosecurity-libs.cmake for details.
+# For now the commit here and the one referenced in sysdig should be in sync.
+LIBS_COMMIT="e5c53d648f3c4694385bbe488e7d47eaa36c229a"
+SRC_URI="https://github.com/falcosecurity/libs/archive/${LIBS_COMMIT}.tar.gz -> falcosecurity-libs-${LIBS_COMMIT}.tar.gz"
+S="${WORKDIR}/libs-${LIBS_COMMIT}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64 ~x86"
+
+RDEPEND="!<dev-util/sysdig-${PV}[modules]"
+
+CONFIG_CHECK="HAVE_SYSCALL_TRACEPOINTS ~TRACEPOINTS"
+
+PATCHES=(
+	"${FILESDIR}"/${PV}-fix-kmod-build-on-5.18+.patch
+	"${FILESDIR}"/${PV}-fix-kmod-build-on-6.2+.patch
+	"${FILESDIR}"/${PV}-fix-kmod-build-on-6.3+.patch
+	"${FILESDIR}"/${PV}-fix-kmod-build-on-6.4+.patch
+)
+
+src_configure() {
+	local mycmakeargs=(
+		# we will use linux-mod, so just pretend to use bundled deps
+		# in order to make it through the cmake setup.
+		-DUSE_BUNDLED_DEPS=ON
+		-DCREATE_TEST_TARGETS=OFF
+		-DDRIVER_VERSION=${LIBS_COMMIT}
+	)
+
+	cmake_src_configure
+
+	# setup linux-mod ugliness
+	MODULE_NAMES="scap(extra:${BUILD_DIR}/driver/src:)"
+	BUILD_PARAMS='KERNELDIR="${KERNEL_DIR}"'
+	# work with clang-built kernels (#816024)
+	if linux_chkconfig_present CC_IS_CLANG; then
+		BUILD_PARAMS+=' CC=${CHOST}-clang'
+		if linux_chkconfig_present LD_IS_LLD; then
+			BUILD_PARAMS+=' LD=ld.lld'
+			if linux_chkconfig_present LTO_CLANG_THIN; then
+				# kernel enables cache by default leading to sandbox violations
+				BUILD_PARAMS+=' ldflags-y=--thinlto-cache-dir= LDFLAGS_MODULE=--thinlto-cache-dir='
+			fi
+		fi
+	fi
+
+	BUILD_TARGETS="all"
+}