The Linux Kernel

The Linux kernel is the core component of the Linux operating system—a bridge between your applications and the computer's hardware. Understanding the kernel is crucial for cybersecurity professionals because many exploitation techniques target kernel vulnerabilities, and privilege escalation often involves kernel exploits. Think of the kernel as the "brain" that manages everything happening on your system.

What You'll Learn

What the kernel is and what it does
Kernel architecture and components
Kernel space vs. user space
System calls and how programs interact with the kernel
Kernel modules and drivers
Security implications and kernel hardening
Why pentesting involves kernel knowledge

What is the Linux Kernel?

The kernel is the first program that loads when Linux boots. It stays running until the system shuts down, managing all resources and providing services to user programs.

Created by Linus Torvalds

First released: August 25, 1991
Initial version: 0.01 (10,239 lines of code)
Current releases move quickly: kernel.org lists Linux 7.0.x as the stable line in May 2026, with 6.18, 6.12, 6.6, 6.1, 5.15, and 5.10 maintained as longterm branches
Open source: Licensed under GPLv2
Maintained by: Thousands of contributors worldwide

What the Kernel Does:

Applications (Firefox, Terminal, Games)
           ↕
    System Libraries (libc)
           ↕
      System Calls (API)
           ↕
    ═══════════════════════
    ║   LINUX KERNEL      ║
    ═══════════════════════
           ↕
    Hardware (CPU, RAM, Disk, Network)

The kernel provides:

Process management - Running multiple programs simultaneously
Memory management - Allocating RAM to programs
Device drivers - Communicating with hardware
System calls - Interface for programs to request services
Security - Permissions, access control, isolation

Kernel Space vs. User Space

Linux divides memory and privileges into two distinct realms:

User Space

Where normal applications run
Limited privileges - cannot directly access hardware
Protected - one program can't crash another
Isolated - programs are sandboxed for security
Examples: Web browsers, text editors, games

Kernel Space

Where the kernel runs
Full privileges - complete hardware access
Critical code - bugs here can crash the entire system
High security - smallest attack surface possible
Performance critical - no overhead from security checks

┌─────────────────────────────────────┐
│       USER SPACE (Ring 3)           │
│  Applications, User Programs        │
│  Limited Privileges                 │
├─────────────────────────────────────┤
│       KERNEL SPACE (Ring 0)         │
│  Core Kernel, Drivers, Modules      │
│  Full System Privileges             │
└─────────────────────────────────────┘

Why This Matters for Security:

Privilege Escalation: Most exploits aim to go from user space → kernel space to gain root access.

Kernel Exploits: A vulnerability in kernel space gives an attacker complete system control.

Protection Rings: Modern CPUs enforce this separation (x86: Ring 0 = kernel, Ring 3 = user).

System Calls: The Bridge Between User and Kernel

Programs cannot directly access hardware—they must ask the kernel through system calls (syscalls).

How System Calls Work:

// User program wants to read a file
int fd = open("/etc/passwd", O_RDONLY);  // System call!
char buffer[100];
read(fd, buffer, 100);                   // System call!
close(fd);                               // System call!

Behind the scenes:

Program executes open() (library function)
Library triggers a system call (software interrupt)
CPU switches to kernel mode
Kernel validates request (permissions, file exists?)
Kernel performs the action
Kernel returns result to user space
CPU switches back to user mode

Common System Calls:

Category	System Calls	Purpose
File Operations	`open, read, write, close, stat`	File I/O
Process Control	`fork, exec, exit, wait, kill`	Process management
Memory	`brk, mmap, munmap`	Memory allocation
Network	`socket, bind, listen, accept, connect`	Networking
Security	`chmod, chown, setuid, setgid`	Permissions

View System Calls in Action:

# Trace system calls of a command
strace ls /tmp

# Output shows every syscall:
# openat(AT_FDCWD, "/tmp", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
# getdents64(3, /* 10 entries */, 32768) = 280
# write(1, "file1\nfile2\n", 12)         = 12

Pentesting Tip: strace reveals how programs work internally and can expose sensitive information like passwords passed on command line.

Kernel Architecture

Monolithic vs. Microkernel

Linux = Monolithic Kernel

All core services run in kernel space
Device drivers are part of the kernel
Faster - no context switching between components
Less secure - one bad driver can crash everything

Microkernel (e.g., Minix, QNX)

Minimal kernel - only essential services
Drivers run in user space
More secure - isolated components
Slower - more context switching overhead

Linux uses a modular monolithic approach—best of both worlds:

Monolithic core for performance
Loadable modules for flexibility

Kernel Components

1. Process Scheduler

Decides which program runs when on the CPU.

# View process priorities
ps -eo pid,ni,pri,comm

# Change process priority (requires root)
sudo renice -n -5 -p 1234  # Higher priority

CPU Time Allocation:

Real-time processes: Critical tasks (audio, video)
Normal processes: Regular applications
Nice values: -20 (highest priority) to +19 (lowest)

2. Memory Management

Manages RAM and virtual memory (swap).

# View memory usage
free -h

# Virtual memory statistics
vmstat 1

# Memory map of a process
cat /proc/1234/maps

Key Concepts:

Virtual memory: Each process thinks it has all RAM to itself
Paging: Memory divided into 4KB pages
Swap: Disk space used when RAM is full
OOM Killer: Kills processes when memory is critically low

3. Virtual File System (VFS)

Unified interface for all filesystems (ext4, NTFS, NFS, etc.)

# View mounted filesystems
mount

# Filesystem types
cat /proc/filesystems

4. Network Stack

Handles all networking (TCP/IP, routing, firewalls).

# View network statistics
netstat -i
ss -tuln

# Routing table
ip route show

5. Device Drivers

Code that allows kernel to communicate with hardware.

# List loaded drivers
lsmod

# Hardware information
lspci  # PCI devices
lsusb  # USB devices

Kernel Modules

Kernel modules are pieces of code that can be loaded/unloaded into the kernel dynamically—no reboot needed!

Why Modules?

Add device drivers on-demand
Extend kernel functionality
Reduce kernel size (only load what you need)
Develop/test without rebooting

Working with Modules:

# List loaded modules
lsmod

# Information about a module
modinfo e1000  # Intel network driver

# Load a module
sudo modprobe nouveau  # Nvidia driver

# Unload a module
sudo modprobe -r nouveau

# View module dependencies
lsmod | grep nvidia

Module Locations:

/lib/modules/$(uname -r)/ - Current kernel's modules
/etc/modprobe.d/ - Module configuration

Security Implications:

⚠️ Rootkits often install malicious kernel modules to hide themselves.

# Check for suspicious modules
lsmod | grep -i hide
lsmod | grep -i rootkit

# Verify module signatures (if enabled)
modinfo module_name | grep sig

Kernel Module Signing: Modern kernels can require signed modules (prevents loading malicious modules).

Kernel Versions and Release Cycle

Version Numbering:

6.5.7
│ │ │
│ │ └─── Patch level (bug fixes)
│ └───── Minor version
└─────── Major version

Types of Kernels:

Mainline: Latest development version Stable: Current production-ready version Longterm: Maintained for years (servers, embedded) End of Life (EOL): No longer supported - security risk!

# Check your kernel version
uname -r
# Output: 6.5.0-kali3-amd64

# Detailed kernel info
uname -a

# View kernel release info
cat /proc/version

Updating the Kernel:

# Debian/Ubuntu/Kali
sudo apt update
sudo apt upgrade linux-image-amd64

# View installed kernels
dpkg --list | grep linux-image

# Reboot to use new kernel
sudo reboot

Kernel Security Features

1. Address Space Layout Randomization (ASLR)

Randomizes memory addresses to make exploits harder.

# Check ASLR status (0=off, 1=conservative, 2=full)
cat /proc/sys/kernel/randomize_va_space

# Enable full ASLR
echo 2 | sudo tee /proc/sys/kernel/randomize_va_space

2. Data Execution Prevention (DEP/NX)

Marks memory as either executable or writable (not both).

# Check if CPU supports NX
grep nx /proc/cpuinfo

3. Stack Canaries

Detect buffer overflow attempts.

4. Kernel Address Space Layout Randomization (KASLR)

Randomizes kernel memory addresses.

# Check if KASLR is enabled
dmesg | grep -i kaslr

5. Seccomp (Secure Computing Mode)

Restricts system calls a process can make.

# View seccomp status of a process
grep Seccomp /proc/1234/status

6. SELinux / AppArmor

Mandatory Access Control (MAC) systems.

# SELinux status
sestatus

# AppArmor status
sudo aa-status

Kernel in Penetration Testing

Why Kernel Knowledge Matters:

1. Privilege Escalation

Most local privilege escalation exploits target kernel vulnerabilities.

# Check kernel version for known exploits
uname -r
searchsploit "linux kernel $(uname -r | cut -d'-' -f1)"

2. Kernel Exploits

Examples of famous kernel exploits:

Dirty COW (CVE-2016-5195) - Write to read-only files
Dirty Pipe (CVE-2022-0847) - Overwrite data in arbitrary files
PwnKit (CVE-2021-4034) - Polkit privilege escalation

# Search for kernel exploits on target
ls -la /tmp/*.sh
find / -perm -4000 2>/dev/null  # SUID binaries

3. Enumeration

Gather kernel information during recon:

# Kernel version
uname -a

# Kernel modules
lsmod

# System calls available
cat /proc/kallsyms  # Kernel symbols (requires root)

# Kernel config (if available)
cat /boot/config-$(uname -r) | grep CONFIG_

4. Rootkit Detection

Hidden processes, network connections, kernel modules:

# Check for hidden modules
lsmod vs. cat /proc/modules

# Tools: chkrootkit, rkhunter
sudo chkrootkit
sudo rkhunter --check

5. Container Escapes

Many container escapes exploit kernel features:

Shared kernel between containers and host
Misconfigurations in namespaces/cgroups
Kernel vulnerabilities affect all containers

Kernel Debugging and Development

View Kernel Logs:

# View kernel ring buffer
dmesg

# Recent kernel messages
dmesg | tail -50

# Filter for errors
dmesg | grep -i error

# Follow kernel messages live
dmesg -w

# System logs
journalctl -k  # Kernel messages

Kernel Parameters:

# View all kernel parameters
sysctl -a

# View specific parameter
sysctl kernel.hostname

# Change parameter (temporary)
sudo sysctl -w kernel.dmesg_restrict=0

# Make permanent (add to /etc/sysctl.conf)
echo "kernel.dmesg_restrict=0" | sudo tee -a /etc/sysctl.conf

/proc and /sys Filesystems:

Virtual filesystems that expose kernel information:

# Process information
cat /proc/cpuinfo      # CPU details
cat /proc/meminfo      # Memory stats
cat /proc/version      # Kernel version
ls /proc/[PID]/        # Per-process info

# System devices and drivers
ls /sys/class/net/     # Network interfaces
ls /sys/block/         # Block devices
cat /sys/class/power_supply/BAT0/capacity  # Battery %

Kernel Hardening

Best Practices:

Keep kernel updated: Patch vulnerabilities

sudo apt update && sudo apt upgrade

Enable security features:

# /etc/sysctl.conf or /etc/sysctl.d/
kernel.dmesg_restrict=1              # Restrict dmesg
kernel.kptr_restrict=2               # Hide kernel pointers
kernel.perf_event_paranoid=3         # Restrict performance monitoring
kernel.unprivileged_bpf_disabled=1   # Disable unprivileged BPF

Use signed modules: Prevent loading unauthorized modules
Enable SELinux/AppArmor: Mandatory access control
Disable unnecessary modules:

# Blacklist module
echo "blacklist usb-storage" | sudo tee -a /etc/modprobe.d/blacklist.conf

Limit core dumps:

echo "kernel.core_pattern=/dev/null" | sudo tee -a /etc/sysctl.conf

Try It Yourself

Beginner Exercises:

Check your kernel version:

uname -r
uname -a
cat /proc/version

Explore loaded modules:

lsmod | wc -l  # How many modules?
lsmod | head   # First 10 modules
modinfo bluetooth  # Info about Bluetooth module

View kernel messages:

dmesg | less
dmesg | grep -i error
dmesg | grep -i usb

Explore /proc:

cat /proc/cpuinfo | grep "model name"
cat /proc/meminfo | grep MemTotal
cat /proc/uptime  # System uptime in seconds

Trace system calls:

strace -c ls     # Count syscalls
strace date      # Trace date command
strace -e open cat /etc/passwd  # Only show 'open' calls

Intermediate Challenge:

Write a bash script that:

Checks kernel version
Searches for known exploits (using searchsploit)
Lists loaded kernel modules
Checks for security features (ASLR, NX)
Generates a report

Solution Hint

#!/bin/bash
echo "=== Kernel Information ==="
uname -a
echo ""
echo "=== ASLR Status ==="
cat /proc/sys/kernel/randomize_va_space
echo ""
echo "=== Loaded Modules ==="
lsmod | head -10

Common Misconceptions

❌ "The kernel is the operating system" ✅ Kernel + userspace tools = complete OS

❌ "All kernel modules are safe" ✅ Malicious modules can completely compromise a system

❌ "User space programs are isolated from the kernel" ✅ They interact constantly through system calls

❌ "You need to compile the kernel to use Linux" ✅ Pre-compiled kernels work fine; custom compilation is for optimization

Resources

Documentation:

The Linux Kernel Documentation - Official docs
Linux Kernel Archives - Download kernels
KernelNewbies - Beginner-friendly resources

Books:

"Linux Kernel Development" by Robert Love
"Understanding the Linux Kernel" by Daniel P. Bovet
"The Linux Programming Interface" by Michael Kerrisk

Kernel Exploit Resources:

Tools:

strace - Trace system calls
ltrace - Trace library calls
linux-exploit-suggester - Find kernel exploits

# Install exploit suggester
git clone https://github.com/mzet-/linux-exploit-suggester.git
cd linux-exploit-suggester
./linux-exploit-suggester.sh

Next Steps

Practice with strace: Understand how programs interact with the kernel
Explore /proc and /sys: Learn what information is exposed
Read kernel logs: Get comfortable with dmesg
Next lesson: Learn about cryptography and secure communications
Lab exercise: Set up a vulnerable VM and research kernel exploits for its version

Remember: The kernel is the most privileged part of the system. Understanding it is essential for both offensive and defensive cybersecurity work!

"If you think your users are idiots, only idiots will use it." - Linus Torvalds (but also: protect the kernel from idiots!)