grep -rl "kernel" ./blog

The Linux Kernel

What the kernel actually is and does: its relationship to the distribution around it, modules and drivers, process signals, and the interfaces it exposes.

33 articles

How to Check Whether Your Linux Kernel Is Patched Against a CVE uname -r does not tell you whether a fix is in your kernel, because distributions backport patches without changing the version. How to check a specific CVE on Debian, Ubuntu, Fedora, RHEL, and Arch, and how to confirm you are actually running the fixed kernel. sched_ext Explained: Swapping the Linux CPU Scheduler at Runtime With BPF Since Linux 6.12 you can replace the CPU scheduler on a running system with one written in BPF, and switch back without rebooting. How sched_ext works, what scx_lavd and the other schedulers do, and whether it helps gaming. zswap vs zram: Which Compressed Swap Should You Use? Both compress memory to stretch your RAM, but zram is a swap device in RAM while zswap is a compressed cache in front of disk swap. How each works, how to check and configure them, why you should not stack them, and which to pick. The /boot Directory Explained: vmlinuz, initramfs and the EFI Partition What each file in /boot does, why /boot/efi is a different filesystem with different rules, why the partition fills up and takes your next kernel update with it, and what is safe to delete when it does. CPU Frequency Scaling and Governors: schedutil, the Intel Driver and EPP Your CPU does not run at its rated speed most of the time. Which driver you have decides which governors exist, why Intel systems only offer two, what energy performance preference actually controls, and when any of this is worth changing. The /dev Directory Explained: Device Files, null, zero and random Everything in /dev is a file that is not a file. Block versus character devices, why /dev/null and /dev/zero differ, what /dev/random actually blocks on now, and why the directory is rebuilt from nothing on every boot. Inodes, Dentries and the Page Cache: What Happens When You Open a File A path is not a file. Resolving one walks a cache of directory entries to find an inode, which points at data the kernel keeps in the page cache. Understanding those three explains disk full errors with free space, and why the second read is instant. io_uring Explained: Why Linux Needed a Third Async I/O Interface Two shared ring buffers replace a syscall per operation. What was wrong with epoll and AIO, how submission and completion queues work, why polled mode can do I/O with zero syscalls, and the security tradeoff that has distributions disabling it. Linux GPU Drivers Explained: amdgpu, i915, Xe, nouveau and NVIDIA Which driver your card uses, why AMD and Intel work out of the box while NVIDIA does not, what the open NVIDIA kernel modules actually changed, and how to tell what is loaded before you start changing things. perf Explained: Finding Out Where the CPU Time Actually Goes strace shows syscalls and gdb shows a stopped program. perf samples a running process thousands of times a second and tells you which functions are burning CPU, with flame graphs, without recompiling anything. sysfs Explained: What /sys Is and How to Read It procfs is about processes. sysfs is about devices, drivers and the kernel object model, and almost every tuning knob people paste into a terminal is a file in here. How it is organised and how to change things so they survive a reboot. Kernel Live Patching: Fixing the Kernel Without Rebooting How livepatch redirects functions in a running kernel, why it only covers a subset of fixes, and why it delays reboots rather than eliminating them. Reading a Kernel Panic or Oops What the RIP line tells you, how to read a call trace, the difference between a panic and an oops, and how to capture one from a machine that froze with nothing on screen. Secure Boot with Your Own Keys Replacing Microsoft's keys with your own so Secure Boot verifies what you chose rather than what a vendor signed. Including how to avoid bricking the machine. eBPF and bpftrace Explained How eBPF runs sandboxed programs inside the kernel, what the verifier will and will not allow, and the bpftrace one-liners that answer production questions strace cannot. Hugepages and NUMA Explained How TLB misses cost performance, the difference between transparent and explicit hugepages, why databases disable THP, and reading NUMA topology properly. inotify and File Watching Explained How the kernel notifies programs about file changes, why you keep hitting the watch limit, and what fanotify does that inotify cannot. Kernel Command Line Parameters Explained How to read /proc/cmdline, set parameters temporarily from the GRUB menu, make them permanent, and the ones worth knowing for rescue and troubleshooting. The OOM Killer Explained: Why Linux Killed Your Process How memory overcommit leads to the OOM killer, how it picks a victim, how to read the kernel log entry, and how to stop it choosing the wrong process. DKMS Explained: Why Your Driver Breaks on Kernel Updates Out-of-tree kernel modules have to be rebuilt for every kernel. DKMS automates that, and understanding it is the difference between a routine update and booting to a black screen. Linux I/O Schedulers: mq-deadline, BFQ, Kyber, and none The scheduler decides the order requests reach your disk. On spinning rust it matters enormously, on NVMe it often should be switched off, and the right default differs per device. Linux Namespaces Explained: What a Container Actually Is A container is not a thing the kernel knows about. It is a normal process with a restricted view of the system, built from namespaces, cgroups, and a changed root. Here is what each piece does. GRUB Explained: Configuration, Kernel Parameters, and Repair GRUB is the last thing that runs before the kernel and the first thing to blame when a machine will not boot. Here is how its configuration actually works and why editing the generated file is the wrong move. initramfs Explained: The Tiny Filesystem That Boots Your Real One Between the kernel starting and your root filesystem mounting sits a small temporary system that loads the drivers needed to find the real disk. Here is what it does and how to rebuild it when it breaks. udev Rules Explained: Making Devices Behave the Way You Want Device names are not stable, permissions default to root, and nothing happens automatically when you plug something in unless you tell it to. udev rules fix all three. dmesg Explained: Reading Kernel Messages When Hardware Misbehaves When a disk fails, a USB device does not enumerate, or the kernel kills a process for using too much memory, it says so in the kernel ring buffer. dmesg is how you read it. sysctl Explained: Reading and Changing Kernel Parameters IP forwarding, swappiness, file descriptor limits, and connection backlogs are all kernel parameters you can read and change at runtime. Here is how sysctl works and which settings are actually worth touching. Kernel Modules Explained: lsmod, modprobe, and DKMS Most drivers on Linux are kernel modules, loaded and unloaded at runtime. Here is how to inspect them with lsmod and modinfo, manage them with modprobe, blacklist the troublesome ones, and understand what DKMS rebuilds. The /proc Filesystem Explained /proc is a virtual filesystem that exposes live kernel and process information as ordinary files, and it is what tools like ps, free, and top actually read from. This guide covers what /proc is, its most useful files, and how to read it directly. Linux Boot Process Explained From pressing the power button to a login prompt, a Linux system goes through a precise sequence of steps. Understanding each stage -- firmware, bootloader, kernel, initrd, and systemd -- demystifies boot failures and makes the system less of a black box. Linux Kernel vs Operating System: What's the Difference? The kernel and the operating system are not the same thing. Understanding the difference explains why "Linux" runs on everything from servers to smartphones, and why your distro matters as much as the kernel inside it. Understanding Linux Processes Every running program on Linux is a process. Understanding process IDs, states, parent-child relationships, signals, and how the kernel schedules work is essential for diagnosing problems and administering any Linux system. What Is Linux? Linux is the kernel at the heart of most of the internet, Android, and a growing share of desktops. Here is what it actually is, how it got here, and why it matters in 2026.

Browse all topics →