Post #2500063
2026-05-09 13:25 UTC
Quick reminder in light of the recent #LinuxKernel vulnerabilities:
In case you want to protect yourself against vulnerabilities in #Linux #Kernel modules you don't need, disable module loading completely by running:
echo 1 | sudo tee /proc/sys/kernel/modules_disabled
Of course you want to load all modules you need before running that command, as otherwise you will have to reboot to load them. 😄
More details on this:
* https://dfir.ch/posts/today_i_learned_lkm_kernel.modules_disabled/
* https://linux-audit.com/kernel/increase-kernel-integrity-with-disabled-linux-kernel-modules-loading/
* https://www.heise.de/select/ct/2020/1/1577462303523965 [German]
Replies (2)
-
@dalias@hachyderm.io 2026-05-09 13:32
@kernellogger@hachyderm.io It would be better to do this in a way that's reversible without reboot. Like setting the modprobe command sysctl to /bin/false.
-
@a1ba@suya.place 2026-05-11 06:53
@kernellogger@hachyderm.io never heard of this before, thanks!