The new Modules tab in Kernel Security Checker: paste your lsmod output and get a list of modules that are unnecessary attack surface or tied to a CVE, plus a ready-to-use blacklist for /etc/modprobe.d/.

How LKRG (Linux Kernel Runtime Guard) works — a kernel module protecting against rootkits and privilege escalation exploits. Installation and comparison with Grsecurity.