What it means
Kernel module security governs which code may extend the operating-system kernel, when modules may load, and how unsupported or unnecessary drivers are prevented from expanding privilege.
Why it matters
Kernel extensions execute with exceptional privilege; weak control over them can turn a routine driver or troubleshooting change into a system-wide compromise.
Practical focus
- Define the kernel extensions permitted on each Linux role and the security outcome it must support
- Apply module allowlists, signing expectations, least functionality, and controlled loading through documented, reviewable configuration
- Verify loaded-module inventories, denied-load events, and configuration drift after changes and on a scheduled basis
- Plan for a required driver being blocked or an unapproved module being introduced, including rollback, ownership, and escalation
Common mistakes
- Enabling a feature without defining what it should protect
- Relying on defaults or one-time validation
- Granting broad exceptions that erase the control boundary
- Treating a required driver being blocked or an unapproved module being introduced as an operational surprise instead of a test case
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: