To date, all of the discussion over what GRsec has done is about distribution rights, but it appears the GRsec agreement[0] also contains this:
> If the User has received pricing for the stable patches on a specific product, use of the patches on additional products without the consent of the Company will result in termination of access to future updates of grsecurity stable patches and changelogs.
So while the patches are derivative works of the upstream kernel, which is GPL licensed, they're attempting to restrict the use of the patched kernel source as well by requiring "consent" to use the combined work, the bulk of which was not written by the GRsec developers and has been licensed directly from the upstream kernel authors to anyone who receives it.
That directly contradicts freedom 0: the freedom to run the program as you wish, for any purpose.