Skip to content

Kernel Modules

A kernel module is a piece of kernel code, usually a driver or a protocol, that loads into the running kernel without a reboot. Loading, blocking and configuring modules matters for storage drivers, Kubernetes networking and hypervisor conflicts.

Track: Core · Interview weight: Med

Must-Know Facts

Fact Value Verify with
Location /lib/modules/$(uname -r)/kernel/**.ko (often .ko.xz or .ko.zst) find /lib/modules/$(uname -r) -name "*.ko*"
List loaded lsmod (reads /proc/modules): name, size, use count, users lsmod
Details modinfo <name>: file, license, dependencies, signature, parameters modinfo -p nbd
Load modprobe <name> resolves dependencies from modules.dep; insmod needs a path and resolves nothing modprobe -v <name>
Unload modprobe -r (with unused dependencies) or rmmod; fails while in use lsmod use count
Built-in Code compiled into the kernel image; cannot be unloaded; listed in modules.builtin modinfo loop shows (builtin)
Parameters modprobe nbd nbds_max=4, persistently options nbd nbds_max=4 in /etc/modprobe.d/*.conf cat /sys/module/nbd/parameters/nbds_max
Blacklist blacklist <name> stops automatic loading only modprobe -c
Block completely install <name> /bin/false makes every load fail modprobe <name>
Load at boot One name per line in /etc/modules-load.d/*.conf, read by systemd-modules-load.service systemctl status systemd-modules-load
Dependency index depmod -a rebuilds modules.dep after adding a module ls /lib/modules/$(uname -r)/modules.dep
Taint Out-of-tree or unsigned modules set /proc/sys/kernel/tainted cat /proc/sys/kernel/tainted
Early boot Storage drivers needed to mount / must be in the initramfs lsinitrd or lsinitramfs

Listing and Inspecting

lsmod | head -6
modinfo sctp | grep -E "^(filename|description|license|depends|intree|vermagic|sig_id|signer)"
modinfo -p nbd

Output:

Module                  Size  Used by
crc32_pclmul           16384  0
crc32c_intel           24576  0
ghash_clmulni_intel    16384  0
aesni_intel           389120  0
crypto_simd            16384  1 aesni_intel
filename:       /lib/modules/6.1.167/kernel/net/sctp/sctp.ko
license:        GPL
description:    Support for the SCTP protocol (RFC2960)
depends:        
intree:         Y
vermagic:       6.1.167 SMP preempt mod_unload modversions 
sig_id:         PKCS#7
signer:         Build time autogenerated kernel key
nbds_max:number of network block devices to initialize (default: 16) (int)
max_part:number of partitions per device (default: 16) (int)

Used by is a reference count followed by the modules that depend on this one. vermagic must match the running kernel, which is why a module built for another kernel version refuses to load.

Built-in versus loadable

modinfo dummy 2>&1 | head -5; modinfo loop 2>&1| head -4
grep -E "loop|dummy" /lib/modules/$(uname -r)/modules.builtin
ls /sys/module/loop; cat /sys/module/loop/parameters/max_loop

Output:

name:           dummy
filename:       (builtin)
alias:          rtnl-link-dummy
license:        GPL
file:           drivers/net/dummy
name:           loop
filename:       (builtin)
alias:          devname:loop-control
alias:          char-major-10-237
kernel/drivers/block/loop.ko
kernel/drivers/net/dummy.ko
kernel/net/vmw_vsock/vsock_loopback.ko
parameters
uevent
8

A built-in driver never appears in lsmod, but its parameters are still under /sys/module/<name>/parameters/, and they are set on the kernel command line as loop.max_loop=16. This matters when a guide says modprobe loop max_loop=16 and nothing changes.

Loading and Unloading

modprobe looks names up in the dependency index; insmod takes a file path and does not. A loaded module cannot be loaded twice.

modprobe sctpp
insmod sctp
insmod /lib/modules/$(uname -r)/kernel/net/sctp/sctp.ko

Output:

modprobe: FATAL: Module sctpp not found in directory /lib/modules/6.1.167
insmod: ERROR: could not load module sctp: No such file or directory
insmod: ERROR: could not insert module /lib/modules/6.1.167/kernel/net/sctp/sctp.ko: File exists

Unloading fails while anything holds a reference. sctp keeps a use count of 4 from the moment it loads, so it stays until reboot on this kernel:

modprobe -r libcrc32c
rmmod sctp; lsmod | grep -E "^(sctp|libcrc32c)"
modprobe -v -r sctp

Output:

modprobe: FATAL: Module libcrc32c is builtin.
rmmod: ERROR: Module sctp is in use
sctp                  368640  4
modprobe: FATAL: Module sctp is in use.

A module in use by a VM or a mount cannot be removed

Hypervisors conflict this way. Since Linux 6.12, kvm_intel and kvm_amd enable the CPU's virtualization extensions as soon as they load, and VirtualBox VMs then fail to start; modprobe -r kvm_intel in turn fails while a KVM guest runs. Stop the guest, unload the module, or blacklist the one that should not load.

Parameters, Blacklists and Boot Loading

As root on Rocky:

echo "options nbd nbds_max=4" > /etc/modprobe.d/nbd.conf; modprobe nbd; cat /sys/module/nbd/parameters/nbds_max; ls /dev/nbd*
modprobe -c | grep -E "^options nbd"

Output:

4
/dev/nbd0
/dev/nbd1
/dev/nbd2
/dev/nbd3
options nbd nbds_max=4

A blacklist line only prevents automatic loading by alias (udev and hardware detection). An explicit modprobe still loads the module; install <name> /bin/false is what makes loading fail.

modprobe -r nbd; printf "blacklist nbd\n" > /etc/modprobe.d/blacklist-nbd.conf; modprobe nbd; lsmod | grep ^nbd
modprobe -r nbd; printf "blacklist nbd\ninstall nbd /bin/false\n" > /etc/modprobe.d/blacklist-nbd.conf; modprobe nbd; echo "rc=$?"; lsmod | grep -c ^nbd

Output:

nbd                    49152  0
modprobe: ERROR: libkmod/libkmod-module.c:1084 command_do() Error running install command '/bin/false' for module nbd: retcode 1
modprobe: ERROR: could not insert 'nbd': Invalid argument
rc=1
0

Modules listed in /etc/modules-load.d/ load at every boot. Restarting the service applies a new file at once; nbd was not loaded before:

lsmod | grep -c ^nbd
echo nbd > /etc/modules-load.d/nbd.conf; systemctl restart systemd-modules-load; lsmod | grep ^nbd; journalctl -u systemd-modules-load -b -o cat --no-pager | tail -2

Output:

0
nbd                    49152  0
Inserted module 'nbd'
Finished systemd-modules-load.service - Load Kernel Modules.

Blacklisting a storage or graphics driver needs a new initramfs

If the module is in the initramfs, it loads before /etc/modprobe.d/ is read from the root filesystem. Rebuild with dracut -f (RHEL) or update-initramfs -u (Ubuntu), or add modprobe.blacklist=<name> to the kernel command line.

The playground kernel and its modules come from iximiuz Labs, not from the Rocky or Ubuntu kernel packages, so module lists and built-in choices differ from a stock install.

Common Errors

modprobe: FATAL: Module sctpp not found in directory /lib/modules/6.1.167

Cause: A typo, a module for another kernel, or modules for the running kernel are not installed (common after a kernel update without a reboot, or in containers).

Fix: find /lib/modules/$(uname -r) -name "name*"; install kernel-modules-extra (RHEL) or linux-modules-extra-$(uname -r) (Ubuntu) for less common drivers.

rmmod: ERROR: Module sctp is in use

Cause: The use count is above zero: a dependent module, an open device, a mount or a socket holds it.

Fix: lsmod shows the users; stop what uses it, or reboot with the module blacklisted.

insmod: ERROR: could not insert module ...: File exists

Cause: The module is already loaded.

Fix: Check lsmod; to change parameters, unload it first or use /sys/module/<name>/parameters/ if the parameter is writable.

Interview Checkpoints

L1: What is the difference between modprobe and insmod?

Say first: modprobe takes a name and loads dependencies from modules.dep, and reads /etc/modprobe.d; insmod loads one file by path with no dependency handling.

Proof: modprobe --show-depends <name>; insmod sctp fails without a path.

Follow-up: Which command rebuilds the dependency index?

L1: Does blacklisting a module stop it from loading?

Say first: Only from automatic loading; an explicit modprobe or a dependency still loads it. install <name> /bin/false blocks it completely.

Proof: The nbd demo above: loaded after blacklist, refused after install.

Follow-up: Why can a blacklisted storage driver still load at boot? (The initramfs.)

L2: Load a module at every boot with a parameter.

Say first: The name in /etc/modules-load.d/, the parameter in /etc/modprobe.d/.

Proof: echo nbd | sudo tee /etc/modules-load.d/nbd.conf; echo "options nbd nbds_max=4" | sudo tee /etc/modprobe.d/nbd.conf; after reboot cat /sys/module/nbd/parameters/nbds_max.

Follow-up: How do you set a parameter of a built-in driver? (Kernel command line, name.param=value.)

L2: Which driver does a network card use?

Say first: lspci -k shows the driver in use; ethtool -i shows it per interface.

Proof: lspci -k | grep -A3 Ethernet; ethtool -i eth0.

Follow-up: Where is the driver's module file? (modinfo -n <driver>.)

L2: Remove a module and everything it pulled in.

Say first: modprobe -r removes the module and unused dependencies; rmmod removes one.

Proof: sudo modprobe -r -v <name>

Follow-up: Why can it still fail? (Use count above zero.)

L3: VirtualBox VMs fail to start on a Linux host that also has KVM. What do you check?

Say first: Whether the KVM modules are loaded and holding the CPU's virtualization extensions (the default since Linux 6.12).

Proof: lsmod | grep kvm; sudo modprobe -r kvm_intel (or kvm_amd) when no KVM guest runs; blacklist kvm_intel to make it permanent.

Follow-up: What is the trade-off of blacklisting KVM?

L3: After a kernel update, a service fails because a module is not found. Why?

Say first: The host still runs the old kernel while the old modules were removed, or the new kernel lacks an extra modules package.

Proof: uname -r vs ls /lib/modules; rpm -q kernel-modules-extra or dpkg -l linux-modules-extra-$(uname -r).

Follow-up: Why is a reboot after a kernel update part of the change?

Captured on Rocky Linux 10.2 (iximiuz Labs microVM, kernel 6.1.167), 2026-09.