Every loaded kernel module is a piece of code running with the highest privileges. The more you have, the larger your attack surface. The catch is that a typical system loads modules nobody deliberately enabled: legacy network protocols, exotic filesystems, drivers for hardware you do not even own.

So far Kernel Security Checker looked at your configuration and kernel version. Now there is a third angle: what is actually loaded right now.

What the Modules tab does

You paste your lsmod output and the tool matches the list against a database of high-risk modules, showing:

  • modules that are unnecessary attack surface — legacy network protocols (dccp, sctp, rds, tipc, appletalk), rare filesystems (cramfs, freevxfs, jffs2, udf) and buses with direct DMA access to memory (FireWire, Thunderbolt) plus Bluetooth,
  • modules tied to a known CVE — for example esp4/esp6 and rxrpc from the Dirty Frag chain, or algif_aead from CopyFail,
  • a ready-to-use blacklist for /etc/modprobe.d/.

Findings come at two levels: red (tied to a CVE, worth handling right away) and orange (unnecessary attack surface, disable if unused).

How to use it

Grab the list of loaded modules:

lsmod > modules.txt

Paste the content or drop the file into the Modules tab. Nothing is stored; the matching happens in memory.

On a typical desktop you will usually see Bluetooth, FireWire and a few protocols you have never touched. On a server the list tends to be short, but that is exactly where trimming everything unnecessary pays off the most. Common modules (ext4, your NIC driver, NVMe) are deliberately skipped so you are not buried in noise.

Blacklist, not removal

The entries look like this:

install dccp /bin/false
install firewire-core /bin/false

This is stronger than a plain blacklist. The install ... /bin/false form also blocks manual modprobe and loading via dependencies. Put them in a file under /etc/modprobe.d/, for example /etc/modprobe.d/hardening.conf, and rebuild the initramfs (update-initramfs -u on Debian and Ubuntu) so the block applies from early boot.

Important: loaded usually means used

If a module is in your lsmod, something loaded it, often because it is genuinely needed. So:

  • before blocking a network or filesystem module, make sure no service relies on it,
  • only block CVE-related modules (esp4, rxrpc) if you do not use IPsec or AFS. If you do, the better fix is updating the kernel to a patched version rather than disabling the feature.

Treat the result as a list of candidates to review, not a command to paste blindly. The module selection follows public hardening guidance (KSPP, CIS Benchmark) plus our own CVE database.

Related: Dirty Frag: a two-stage page-cache LPE chain | CopyFail: 9 years of hidden privilege escalation

Full configuration and version analysis: Kernel Security Checker