VMware ESXi and vSphere Cluster Management

Linux Kernel Modules: Locations, Loaded Modules, and Module Information

Learn what Linux kernel modules are, where they are stored, how to list loaded modules with lsmod, and how to inspect metadata with modinfo and modprobe.

A kernel module is a separately compiled object file containing code that can extend an already running Linux kernel. A loadable kernel module (LKM) can be inserted into the kernel or removed from it without rebuilding and rebooting the entire kernel.

Modules provide a modular way to add kernel capabilities. Instead of permanently including every possible driver and feature in the core kernel image, Linux can keep optional functionality in separate modules and load it when needed. Device drivers are a common example, but modules can also provide filesystem support, networking features, cryptographic algorithms, and other kernel functionality.

When a compatible module is loaded, its code becomes part of the running kernel. It is not a normal user-space program: it executes with kernel privileges and can interact directly with hardware and other kernel subsystems.

Where Linux Stores Kernel Modules

The conventional top-level directory for installed Linux kernel modules is /lib/modules. Inside it, modules are arranged in subdirectories named after a kernel release. The kernel release is the version identifier used by the currently booted kernel and its matching module tree.

/lib/modules/
├── 5.15.0-example/
├── 6.1.0-example/
└── 6.8.0-example/

Each release directory contains a module tree and supporting metadata. Module files commonly have names ending in .ko (kernel object), although distributions may compress them, producing names such as .ko.xz or .ko.zst.

Find the Module Tree for the Running Kernel

First display the release of the kernel that is currently running:

uname -r

Use that value to inspect the corresponding directory:

ls /lib/modules/$(uname -r)

For example, a system running release 3.0.76-0.11-default would normally use:

/lib/modules/3.0.76-0.11-default

The release-specific name matters because modules are compiled against a particular kernel build. Modules are not generally interchangeable across kernel releases. Differences in kernel interfaces, configuration, compiler settings, and enabled features can make a module incompatible with another kernel.

List Loaded Modules with lsmod

lsmod lists modules that are currently loaded into the running kernel:

lsmod

A typical result has columns similar to these:

Representative output might look like this:

Module                  Size  Used by
md5                    16384  0
nls_utf8               16384  1
some_driver            45056  2 other_module

The reference count is the number shown at the start of the Used by field. A count of 0 means that the kernel currently reports no users or dependent modules for that module. A nonzero count indicates active use by one or more modules or reported consumers. The count is useful for deciding whether removal might be possible, but it is not a complete inventory of every process that might depend on a feature.

In the example, md5 has a count of 0, while nls_utf8 has a count of 1. The exact modules and values vary by system and workload.

Inspect Module Metadata with modinfo

modinfo displays metadata for an installed kernel module. It can receive either a module name or a module filename/path:

modinfo md5
modinfo /path/to/module.ko

Using a name asks the module tools to locate the installed module in the appropriate module tree. Supplying a path directs modinfo to inspect that particular file.

Useful fields may include:

• filename: the installed location of the module file.
• description: a short explanation of the module's purpose.
• license: the module's declared license.
• author: the declared author or maintainer information.
• version: the module's version, when provided.
• alias: an alternate name or hardware-matching pattern that can help the system select the module.
• depends: modules required by this module.
• vermagic: kernel-version and build compatibility information.
• parm: a supported module parameter and sometimes its description.

For example:

modinfo md5

This command can show the filename, description, license, dependencies, aliases, parameters, and other metadata for md5, depending on the distribution and how the module was built.

Installed, Loaded, and Unavailable Modules

Basic Module Loading and Removal

Modules can be loaded automatically when hardware is detected, when another module requires them, or manually by an administrator. The normal dependency-aware command for loading an installed module is modprobe:

modprobe MODULE_NAME

For example, an administrator might inspect a candidate module first and then load it:

modinfo MODULE_NAME
modprobe MODULE_NAME
lsmod

modprobe uses module metadata and dependency information to load required supporting modules as needed. To request removal, use:

modprobe -r MODULE_NAME

Removal normally succeeds only when the module has no active users and no loaded module depends on it. rmmod can also remove a module, but modprobe -r is generally preferred for ordinary module management because it understands dependencies.

Kernel Module Commands

Direct Memory Access and Modules

Direct Memory Access (DMA) is a hardware mechanism that lets a device transfer data to or from system memory with limited CPU intervention. DMA can improve performance for devices that move substantial amounts of data, such as storage controllers and network hardware.

Kernel device drivers commonly configure and coordinate DMA operations, including buffer management, device registers, and interrupt handling. This is a relationship between DMA and kernel functionality, not a statement that every kernel module uses DMA. Many modules implement features that have no connection to device data transfers.

Troubleshooting Module Problems

The Module Directory Does Not Match the Running Kernel

Compare the active release with the directory names:

uname -r
ls /lib/modules

Likely causes include booting a different kernel than expected, missing or incomplete module packages for the current kernel, or installing a kernel update without rebooting into it. Confirm that a complete module tree exists for the active release.

modinfo Cannot Find a Module

First verify the running release and inspect its module tree:

uname -r
ls /lib/modules/$(uname -r)
modinfo MODULE_NAME

The module may not be installed for the current kernel, the name may be incorrect, or dependency metadata may not have been updated after a manual installation. Search the active release tree for the expected module file and use its filename or path with modinfo when appropriate.

A Module Does Not Appear in lsmod

A module can be installed without being loaded. It may also be built directly into the kernel, in which case it will not appear as a loadable module. Hardware or configuration may simply not have triggered automatic loading.

Use modinfo to check whether a module is installed. If it is installed as a module, load it with modprobe only when the feature is appropriate and it is safe to change the running system.

A Module Cannot Be Removed

Check the module's Used by field in lsmod. A nonzero count, a listed dependent module, or an active device, filesystem, or service can prevent removal. Identify the consumers before attempting removal, and never force removal of a module that supports an essential system function.

A Module Fails After a Kernel Change

Check the active release and the module's compatibility metadata:

uname -r
modinfo MODULE_NAME

Look at the module filename and vermagic when present. A module built for another kernel release, mismatched compatibility metadata, or a module tree that does not correspond to the booted kernel can prevent loading. Install or build the correct module for the active kernel.

Exam-Relevant Summary

• A kernel module is a separately compiled object that extends a running Linux kernel.
• /lib/modules contains installed module trees organized by kernel release.
• uname -r identifies the running kernel release.
• lsmod lists modules currently loaded into the running kernel.
• In lsmod, Module is the name, Size is the reported footprint, and Used by begins with a reference count and may list dependents.
• modinfo displays metadata for an installed module but does not prove that it is loaded.
• modprobe is normally used to load modules with dependency handling; modprobe -r requests removal.
• Modules must match the running kernel's release and build compatibility information.
• DMA lets hardware transfer data to or from memory with reduced CPU involvement and is commonly coordinated by device drivers.

For a related reference, see Linux kernel modules.