Kernel modules — loading, inspecting, and blacklisting

Inspecting what is loaded: lsmod and modinfo. lsmod reads /proc/modules and formats it for human consumption. modinfo queries the module metadata from the .ko file itself.

# List all currently loaded modules:
lsmod
# Module                  Size  Used by
# nf_conntrack          172032  2 nf_nat,nf_conntrack_netlink
# ip_tables              36864  1 iptables
# dm_crypt               49152  0
# ...
# Columns: module name | size in bytes | use-count | dependents

# Inspect a specific module:
modinfo ext4
# filename:    /lib/modules/6.1.0-21-amd64/kernel/fs/ext4/ext4.ko
# description: Fourth Extended Filesystem
# author:      Remy Card, Stephen Tweedie, Andrew Morton, ...
# license:     GPL
# depends:     mbcache,jbd2
# retpoline:   Y
# parm:        delayed_allocation:Use delayed allocation during write (bool)
# parm:        ...

# Find the .ko file on disk:
modinfo -n bluetooth
# /lib/modules/6.1.0-21-amd64/kernel/net/bluetooth/bluetooth.ko

# List module parameters (parm lines):
modinfo r8169 | grep parm
# parm:         debug:Debug verbosity level (0=none,...,16=all) (int)

The Used by count tells you whether it is safe to remove a module. A count of 0 means nothing depends on it; a count > 0 means other loaded modules or open devices still need it. rmmod refuses to unload a module with a non-zero use count.

Loading modules with modprobe. modprobe is the correct tool for loading modules — unlike insmod (which requires the full path and ignores dependencies), modprobe reads the dependency database at /lib/modules/$(uname -r)/modules.dep and loads prerequisites automatically.

# Load a module (and its dependencies):
sudo modprobe nf_conntrack
# (no output on success)

# Verify it loaded:
lsmod | grep nf_conntrack
# nf_conntrack          172032  0

# Load with parameters:
sudo modprobe r8169 debug=1
# Sets the debug parameter for the r8169 driver at load time

# List a module's dependencies without loading:
modprobe --show-depends nf_nat
# insmod /lib/modules/.../kernel/net/netfilter/nf_conntrack.ko
# insmod /lib/modules/.../kernel/net/netfilter/nf_nat.ko
# (modprobe would load nf_conntrack first, then nf_nat)

# Dry-run (show what would happen, do not load):
modprobe --dry-run --verbose tcp_bbr

Module parameters passed via modprobe apply for this one load. For permanent parameters, use /etc/modprobe.d/ (covered in Step 4).

Unloading modules with rmmod. An unloaded module frees its memory. This is used during driver debugging (unload, change parameter, reload) and when a module causes instability. Unloading fails if the use count is non-zero.

# Unload a module (fails if anything depends on it):
sudo rmmod nf_conntrack
# rmmod: ERROR: Module nf_conntrack is in use by: nf_nat nf_conntrack_netlink
# → You must unload dependents first

# modprobe -r handles the dependency chain automatically:
sudo modprobe -r nf_nat
# Unloads nf_nat, then nf_conntrack (if no other dependents remain)

# Verify it is gone:
lsmod | grep nf_conntrack
# (no output)

# GOTCHA: some modules cannot be unloaded because something in the kernel
# holds a reference that the use-count doesn't capture cleanly.
# In that case, 'modprobe -r' returns "FATAL: Module ... is in use".
# The only safe option is a reboot. Never use 'rmmod -f' (force) on a
# production system — it bypasses the use-count check and can kernel-panic.

Persistent loading via /etc/modules-load.d and parameters via /etc/modprobe.d.

# Auto-load a module at every boot:
# Drop a .conf file in /etc/modules-load.d/ (one module name per line):
echo "tcp_bbr" | sudo tee /etc/modules-load.d/bbr.conf
# systemd-modules-load.service reads this at boot

# Apply now without rebooting:
sudo modprobe tcp_bbr
sudo sysctl -w net.ipv4.tcp_congestion_control=bbr

# Set permanent module parameters via /etc/modprobe.d/:
sudo tee /etc/modprobe.d/r8169.conf << 'EOF'
# Fix for switch that has auto-negotiation disabled
options r8169 speed=100 duplex=1
EOF
# Parameters take effect the next time the module loads
# (reboot or: modprobe -r r8169 && modprobe r8169)

# Blacklist a problematic module so it never loads:
sudo tee /etc/modprobe.d/blacklist-pcspkr.conf << 'EOF'
# Disable the PC speaker (beep) driver — it causes spurious alerts
blacklist pcspkr
EOF

# GOTCHA: blacklisting does NOT remove an already-loaded module.
# It only prevents future loads. If it is already loaded:
sudo modprobe -r pcspkr
# Then the blacklist prevents it from auto-loading on next boot.

# Verify the blacklist is in effect:
cat /etc/modprobe.d/blacklist-pcspkr.conf
# blacklist pcspkr
lsmod | grep pcspkr
# (no output — module is not loaded)

There is a subtlety: blacklist in /etc/modprobe.d/ prevents modprobe from loading the module automatically, but it does not prevent another module from explicitly loading it as a dependency. For absolute prevention, use install <module> /bin/false in the same file — this makes any load attempt (including via dependencies) invoke /bin/false, which fails.

When a blacklist does not take effect. A common production puzzle: you blacklisted a module, it still loads. The culprit is usually the initramfs.

# The initramfs is the early boot environment that mounts the real root FS.
# It has its own copy of module configs. If your blacklist isn't in there,
# the module loads before /etc/modprobe.d/ is even mounted.

# After creating a blacklist file, rebuild the initramfs:
sudo update-initramfs -u
# update-initramfs: Generating /boot/initrd.img-6.1.0-21-amd64

# Reboot and verify:
lsmod | grep <module-name>
# (should be absent now)

# Confirm which modules are included in the initramfs:
lsinitramfs /boot/initrd.img-$(uname -r) | grep -i <module-name>

# If the module is needed by the initramfs itself (e.g. a filesystem driver),
# you cannot safely blacklist it — the system will fail to boot.
# In that case, use a kernel parameter instead:
# Add to /etc/default/grub GRUB_CMDLINE_LINUX: module_blacklist=nouveau
# Then: sudo update-grub