Linux: introduction to LKMs

The Linux kernel is monolithic: all code runs in the same address space, in privileged mode. But it accepts additional code at runtime: LKMs (Loadable Kernel Modules). An LKM is a .ko file compiled for the running kernel, that inserts into kernel space and adds functionality: device drivers, filesystems, network protocols, custom syscalls.

The smallest LKM

// hello.c
#include <linux/module.h>
#include <linux/kernel.h>

static int __init hello_init(void) {
    printk(KERN_INFO "Hello from kernel space\n");
    return 0;
}

static void __exit hello_exit(void) {
    printk(KERN_INFO "Goodbye from kernel space\n");
}

module_init(hello_init);
module_exit(hello_exit);
MODULE_LICENSE("GPL");

The Makefile:

obj-m += hello.o
all:
	make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules

make
insmod hello.ko       # load the module
dmesg | tail -1       # "Hello from kernel space"
rmmod hello           # unload the module
dmesg | tail -1       # "Goodbye from kernel space"

printk is the kernel’s printf: it writes to the dmesg ring buffer, not to stdout. The kernel has no stdout, no libc, no standard malloc (it has kmalloc), no floating point (by default) and no memory protection between modules: a buggy LKM crashes the entire kernel.

What it means for security

An LKM runs in ring 0: it sees all memory, all processes, all files. A malicious LKM (rootkit) can hide processes, intercept syscalls, hide files and the kernel cannot detect it because the kernel IS the LKM. LKM rootkits (adore, suckit, enyelkm) are the most powerful and hardest to detect.

The countermeasure: disable module loading after boot (sysctl kernel.modules_disabled=1), sign allowed modules (CONFIG_MODULE_SIG) and monitor /proc/modules for unexpected modules.

[edit: 2026] LKMs are still the Linux kernel’s extension mechanism and LKM rootkits are still the most dangerous rootkit class. Modern kernels sign modules (CONFIG_MODULE_SIG_FORCE rejects unsigned modules) and eBPF has taken over part of the custom-LKM role (kernel code without compiling a module, but sandboxed). The modules_disabled=1 remains the most effective measure against LKM rootkits, at the cost of not being able to add drivers after boot.