Kernel Security Checker

Check your Linux kernel security from two angles:

Configuration — kconfig, sysctl, cmdline and loaded modules hardening analysis, per KSPP, grsecurity, CLIP OS and CIS Benchmark.
Vulnerabilities — known CVEs and public exploits matched to your kernel version.

Configuration

Vulnerabilities

Where to find your kernel config file?

/boot/config-$(uname -r) — most common location (Debian, Ubuntu, Fedora)
/proc/config.gz — if kernel built with CONFIG_IKCONFIG_PROC=y, extract: zcat /proc/config.gz > my.config
/usr/src/linux/.config — if you compiled the kernel from source
ls /boot/config-* — lists available configs for installed kernels

How to get sysctl settings?

How to get kernel boot parameters?

How to check your kernel version?

uname -r — shows the running kernel version (e.g. 6.6.8 or 5.15.0-91-generic)
Enter the version and the tool lists known public exploits for that kernel
This matches by version — it does not account for distro-backported patches

How to get the list of loaded modules?

lsmod > modules.txt — save loaded modules to a file
The tool flags modules that are unnecessary attack surface (legacy protocols, rare filesystems, FireWire/Thunderbolt/Bluetooth) and those tied to known CVEs
A loaded module usually means it is in use — only block ones you are sure you do not need

📄

Drag & drop your .config file here or click to browse