The new Modules tab in Kernel Security Checker: paste your lsmod output and get a list of modules that are unnecessary attack surface or tied to a CVE, plus a ready-to-use blacklist for /etc/modprobe.d/.