Remove Loaded Kernel Modules with rmmod in Linux

Learn how to identify and unload loaded Linux kernel modules with rmmod, handle dependencies, verify removal, and understand the risks of forced unloading.

A kernel module is a loadable component that extends the functionality of the running Linux kernel. Modules commonly provide hardware drivers, filesystems, networking features, and other kernel capabilities.

A loaded module is currently present and active in the running kernel. Removing one changes the functionality currently available to the kernel, so module removal should be planned when the module supports an active device, network connection, filesystem, or service.

The rmmod command removes a loaded kernel module. You may remove a module to reclaim memory, troubleshoot a driver, or prepare to load a revised or replacement module.

Prerequisites: You should be comfortable with the Linux command line, sudo, and inspecting loaded modules with lsmod. Removing modules normally requires administrative privileges.

Inspect Loaded Modules Before Removing One

Start by displaying the modules currently loaded into the running kernel:

lsmod

The output includes the module name, its memory usage, and usage information. A typical listing has columns similar to these:

Module: the identifier used to refer to the loaded module.
Size: the amount of kernel memory associated with the module.
Used by: modules or other kernel users that currently depend on it.

Use the exact module identifier shown in the Module column with rmmod. A module name is not necessarily the same as a distribution package name, a human-readable driver description, or a path to a file such as /lib/modules/.../driver.ko.

Basic rmmod Usage

The basic command structure is:

sudo rmmod module_name

Replace module_name with a module that is currently loaded in the running kernel. For example:

lsmod
sudo rmmod example_module
lsmod

The first lsmod confirms that example_module is loaded. The rmmod command then requests normal removal. The final lsmod lets you check whether the module has disappeared from the loaded-module list.

Command — Purpose — Expected behavior — Caution

lsmod — Display loaded modules and usage relationships — Shows modules currently present in the running kernel — Use it before and after removal to confirm the target and result.

sudo rmmod module_name — Unload a named module using normal safety checks — Removes the module if it is loaded and not in use — Removing a driver can make its device or service unavailable.

sudo rmmod -f module_name — Attempt forced removal — Tries to remove a module marked as in use when kernel support is enabled — Can destabilize the system, disrupt services, or cause a crash.

Understand Module Dependencies

A dependency is a relationship in which one module requires another module to remain loaded. For example, a higher-level module may use functionality supplied by a lower-level driver module.

If another loaded module depends on the target, rmmod normally refuses to remove the target. This protects the kernel from losing code that an active module still needs. The refusal or usage information identifies modules that prevent removal when that information is available.

Removal must follow the dependency direction:

Identify the dependent modules reported by the command or shown in the lsmod usage information.
Determine whether those dependents can be stopped or unloaded safely.
Unload dependent modules first.
Retry removal of the module they depended on.

sudo rmmod base_module
sudo rmmod dependent_module
sudo rmmod base_module

Do not unload dependents blindly. A dependent module may support active networking, storage, hardware, filesystems, or other production services. Interrupting it can disconnect the system, make data unavailable, or stop an application.

Forced Module Removal with rmmod -f

The -f option attempts a force unload: removing a module even though it is marked as in use.

sudo rmmod -f example_module

Force removal is available only when the running kernel was built with CONFIG_MODULE_FORCE_UNLOAD enabled. This is a build-time kernel configuration option, not merely a permission that sudo grants at runtime. If the active kernel lacks this support, -f has no effective result.

Verify That Removal Succeeded

Run lsmod again after a successful removal:

lsmod

If the target module no longer appears in the listing, it is no longer loaded in the running kernel. When the module supplied functionality for an active device or service, also check that device or service after removal. A successful command does not mean the functionality is still available.

Common Removal Outcomes

Condition — Why it occurs — Recommended response

Module is not loaded — The module is absent from the running kernel, or the wrong name was supplied — Run lsmod and use the exact module identifier shown there.

Module is in use by another module — A dependent module or another active kernel reference still uses it — Inspect the reported dependents, assess service impact, unload dependents first when safe, then retry.

Insufficient privileges — Kernel module removal normally requires administrative permission — Run the command through sudo or use an authorized administrative shell.

Force unload is unsupported by the kernel — The kernel was not built with CONFIG_MODULE_FORCE_UNLOAD enabled — Do not assume -f overrides kernel policy; resolve dependencies normally or use an explicitly appropriate kernel configuration.

Module removal succeeds — The module was loaded and could be removed safely — Confirm its absence with lsmod, then check any device or service that depended on its functionality.

Troubleshooting rmmod

rmmod reports that the module is in use

Another loaded module may depend on the target, or the target may have active kernel references. Read the command output, inspect lsmod, and unload dependent modules first only when doing so will not interrupt required work. Avoid force removal unless the operational risk is understood and the kernel supports it.

rmmod cannot find the named module

The module may not be loaded, or the command may contain the wrong identifier. Run lsmod and copy the module name from its listing. Do not substitute a package name, description, or filename path.

Permission is denied

Module removal changes the running kernel and therefore normally requires elevated privileges. Use sudo if your account is authorized:

sudo rmmod module_name

rmmod -f does not force removal

The active kernel may not have been built with CONFIG_MODULE_FORCE_UNLOAD. The force flag cannot add support that the kernel configuration does not provide. Resolve dependencies normally, or use a kernel configuration that explicitly supports forced unloading only when appropriate for the environment.

A device or service stops working afterward

The removed module probably provided the driver or kernel functionality required by that device or service. Reload the needed module if appropriate, and avoid removing modules that support active production workloads without assessing the impact first.

Exam-Relevant Notes

rmmod removes a loaded kernel module; it does not remove a package from disk.
lsmod displays modules currently loaded in the running kernel.
A module must normally be unused before rmmod can remove it.
When dependencies exist, unload dependent modules before the module they require.
rmmod -f depends on the kernel build option CONFIG_MODULE_FORCE_UNLOAD and is risky.
Absence from a subsequent lsmod listing verifies that the module is no longer loaded.

For broader command-line context, see Linux and Bourne Again Shell Bash.