How To

lsmod Command in Linux: List and Inspect Kernel Modules

The lsmod command in Linux lists all currently loaded kernel modules. It reads /proc/modules — a virtual file maintained by the kernel — and formats the output into three labeled columns.

lsmod takes no options or arguments.

How to Use the lsmod Command in Linux

Run it without any flags:

bashlsmod

The output looks like this:

Module                  Size  Used bykvm_intel             278528  0kvm                   651264  1 kvm_intelirqbypass              16384  1 kvmahci                   40960  1libahci                32768  1 ahci

Each row has three columns:

  • Module — the name of the loaded module
  • Size — memory used by the module, in bytes
  • Used by — the number of instances currently using it, followed by a comma-separated list of modules that depend on it

A “Used by” count of 0 means the module is loaded but not actively in use and has no dependents. It is a candidate for removal.

Reading Dependencies and Knowing What Can Be Safely Removed

The “Used by” column is the key field for safe module management.

In the output above, kvm_intel depends on kvm — its name appears in kvm‘s dependency list. To remove kvm, you must first run modprobe -r kvm_intel. Attempting to remove kvm while kvm_intel is loaded fails with a “module is in use” error.

Modules reach the system in three ways: automatically by udev when hardware is detected, manually with modprobe, or at boot via /etc/modules or /etc/modules-load.d/*.conf. Modules compiled directly into the kernel at build time are called built-in modules and do not appear in lsmod output at all.

For scripts that need raw module data, read the source file directly:

bashcat /proc/modules

Filter Output and Get Module Details with modinfo

To check whether a specific module is loaded:

bashlsmod | grep kvm

To list modules whose “Used by” count is 0:

bashlsmod | awk '$3 == 0'

$3 targets the third column in each row. A zero count means the module can be unloaded without breaking anything that depends on it.

To get detailed information about a specific module before acting on it:

bashmodinfo kvm

The output includes the file path, license, author, description, and configurable parameters. The file path shows the kernel version the module belongs to. Modules live in /lib/modules/<kernel_version>/ and are version-specific — a module built for one kernel will not load on another.

To unload a module and its dependencies:

bashsudo modprobe -r kvm_intel

Only run modprobe -r after confirming the “Used by” count is 0 and no service or device depends on the module.

Start with lsmod to see what is loaded, use grep to look up a specific module, awk '$3 == 0' to find removal candidates, and modinfo to review details before making changes. Leave a comment below if you run into any issues.

Cyber Defence

Recent Posts

rename Command in Linux: Batch Rename Files with Perl Regex

The rename command in Linux renames multiple files at once using Perl regular expressions. Unlike mv, which handles…

6 minutes ago

pgrep Command in Linux: Find and Filter Running Processes

The pgrep command in Linux finds the PIDs of running processes based on a name or other…

20 hours ago

unlink Command in Linux: Remove a Single File or Symlink

The unlink command in Linux removes a single file by deleting its directory entry. It is a…

21 hours ago

How to Check Open Ports in Linux: nmap, netcat, and Bash

When troubleshooting a network connection or configuring a firewall, the first question is whether a…

21 hours ago

ifconfig Command in Linux: Configure Network Interfaces

The ifconfig command in Linux displays and configures network interfaces. It can assign IP addresses, bring interfaces…

22 hours ago

groupdel Command in Linux: Remove a Group and Audit Files

The groupdel command in Linux removes a group from the system. It deletes the group's entry from /etc/group and /etc/gshadow,…

2 days ago