Linux online course

Linux Kernel Modules: Viewing Loaded Modules and Inspecting Module Information

Learn what Linux kernel modules are, where installed modules are stored, how to use lsmod, and how to inspect module metadata with modinfo.

A Linux kernel module is a separately built object file containing code that can extend the functionality of a running Linux kernel. Modules commonly provide support for hardware devices, filesystems, networking features, storage controllers, and other optional kernel capabilities.

A module is often called a loadable kernel module (LKM) because it can be added to, and sometimes removed from, the running kernel when the system supports and permits that operation. Module files commonly use the .ko extension. They are compiled binary object files and may be compressed, for example with extensions such as .ko.xz or .ko.zst.

Some kernel functionality is compiled directly into the kernel image. That code is present as soon as the kernel boots and does not appear as a separately loaded module in lsmod. Loadable modules, by contrast, are separate files that can be made available when needed.

Why Linux uses kernel modules

A modular kernel does not need to contain every possible driver and feature permanently in the kernel image. Functionality can be installed and loaded when hardware or a feature requires it. This can reduce the size of the core kernel and make support for optional hardware more flexible.

• Device drivers: Modules can support network cards, graphics hardware, USB devices, storage controllers, and other hardware.
• Filesystems: A filesystem implementation can be supplied as a module instead of being built into the kernel.
• Networking: Optional protocols and networking features may be modular.
• Storage and other kernel services: Drivers and subsystems can be added when required.

Modules can have dependencies. A dependency is a relationship in which one module requires another module to work. For example, a device-specific driver may depend on a shared bus, protocol, or support module. Module-management tools use dependency information when selecting and loading modules.

Where installed modules are stored

The conventional root directory for installed Linux kernel modules is /lib/modules. Beneath it, module files are organized into directories named for a kernel release. The kernel release is the version and distribution-specific identifier reported by uname -r.

/lib/modules/<kernel-release>/

First identify the running kernel, meaning the specific kernel currently booted and operating the system:

uname -r

Use that result to inspect the matching module tree:

ls /lib/modules/$(uname -r)

The command substitution $(uname -r) inserts the active kernel release into the path. A typical tree can contain directories such as kernel/, along with dependency databases, alias information, and other module-management files. The exact contents vary by distribution and kernel packaging.

Modules built for one kernel release may not be usable with another release. Therefore, do not assume that a directory for a different installed kernel applies to the kernel that is currently running.

Listing modules loaded into the running kernel

lsmod is the standard command for displaying modules currently loaded into the running kernel:

lsmod

Its output normally has three columns: Module, Size, and Used by. A simplified example looks like this:

Module                  Size  Used by
example_driver         20480  1
shared_support         16384  2 example_driver,another_driver
unused_feature         12288  0

The Used by value is a usage count. A nonzero value is evidence that another component is using the module. A value of zero means the module is loaded but currently has no active references reported by the kernel. It does not, by itself, prove that the module is broken or safe to remove.

Checking one module

Pipe the output through grep -w to search for an exact module name. For example:

lsmod | grep -w md5

If the module is listed, it is currently loaded. If there is no output, the module is not listed as loaded. An absent result can mean that the module is installed but not currently needed, that the feature is compiled into the kernel, or that the module is unavailable for this kernel.

Inspecting module metadata with modinfo

modinfo displays metadata and configuration-relevant information for an installed module. It can accept either a module name or a path to a module file:

modinfo MODULE_NAME
modinfo /path/to/module.ko

For example, inspect a module by name:

modinfo md5

You can also use a path within the active kernel's module tree. The exact location varies by distribution and kernel configuration, so avoid hard-coding a particular subdirectory in general instructions:

modinfo /lib/modules/$(uname -r)/kernel/...

Useful fields in modinfo output include:

• filename: The installed path of the module file.
• description: A brief explanation of the module's purpose.
• license: The license declared by the module.
• author: The module's stated author or authors.
• version: The module's own version, when provided.
• alias: An alternate hardware or feature identifier used by module-management tools to select the module.
• depends: Other modules required by this module.
• parm: A supported module parameter and, often, a description of that parameter.
• vermagic: Compatibility metadata describing the kernel version and build characteristics expected by the module.

modinfo can inspect an installed module even when that module is not currently loaded. It answers a question about an available module file and its metadata, not necessarily about active kernel state.

Installed modules versus loaded modules

Installed and loaded describe different states. A module can exist on disk without being present in kernel memory. Conversely, a loaded module should belong to the compatible module set for the running kernel.

Useful inspection workflow

1. Identify the running kernel release with uname -r.
2. Confirm that a matching directory exists beneath /lib/modules.
3. List active modules with lsmod.
4. Use lsmod | grep -w MODULE_NAME when checking one exact module name.
5. Use modinfo MODULE_NAME to learn what an installed module does and which dependencies or parameters it declares.

Troubleshooting module inspection

The module directory does not match uname -r

Compare the active release with the directory names under /lib/modules. Possible causes include a missing or incomplete module package, booting a different kernel than expected, or running in a container or restricted environment with only a partial filesystem view.

uname -r
ls /lib/modules

The directory corresponding to the active release should normally be present on a complete installation.

modinfo cannot find a module

Check the spelling of the module name and confirm the running release:

uname -r
find /lib/modules/$(uname -r) -type f

The module may not be installed for the current kernel, or a supplied file path may be incorrect. Retry with the correct module name or the full path to the module file. A module installed only under a different release directory is not automatically the correct module for the running kernel.

modinfo finds a module but lsmod does not list it

This is normally not a contradiction. modinfo describes an installed module file or module known to the installed module database, while lsmod reports modules currently active in the running kernel. The hardware or feature may not have required the installed module during the current session.

The Used by value is zero

A zero usage count means the module is loaded but has no current references shown by the kernel. Treat it as status information, not as proof of a failure. A nonzero count indicates that another component is using the module.

Exam-relevant points

• uname -r identifies the release of the currently running kernel.
• /lib/modules/<kernel-release>/ contains installed module files for a particular kernel release.
• lsmod reports modules currently loaded into the running kernel.
• modinfo reports metadata for an installed module, whether or not it is loaded.
• A module's Used by value is a usage count; zero does not automatically mean invalid or unnecessary.
• Module aliases help module-management tools match hardware or feature identifiers to an appropriate module.
• vermagic provides kernel-version and build compatibility information.
• Functionality compiled directly into the kernel does not appear as a separately loaded module.

For related command-line and filesystem fundamentals, see Linux, File Structure in Linux, and Bourne Again Shell Bash.