How To

rmmod Command in Linux: Remove Kernel Modules and Blacklisting

The rmmod command in Linux removes a loaded module from the running kernel. Because the kernel has a modular design, you can load and unload drivers and features on demand, without rebooting or recompiling anything.

This guide covers how to use the rmmod command in Linux, when to use modprobe -r instead, and how to permanently prevent a module from loading at boot.

How the rmmod Command Works in Linux

Kernel modules are stored in /lib/modules/<kernel_version>/. Each directory corresponds to a specific kernel version, which is why modules must be reinstalled after a kernel upgrade.

List all currently loaded modules with:

bashlsmod

To remove a loaded module:

bashsudo rmmod module_name

The command produces no output on success. To remove multiple modules in one step:

bashsudo rmmod module_name1 module_name2

On modern Linux systems, rmmod is part of the kmod package, which provides rmmod, modprobe, lsmod, insmod, and related tools through a single binary with symlinks.

Common options:

  • -v / --verbose — shows what the command is doing step by step
  • -w / --wait — waits for the usage count to drop to zero before removing. Safer than -f when a module is still active
  • -f / --force — forces removal even when the module is in use. Dangerous: the kernel may not clean up properly if another module is mid-operation, which can cause a crash
  • -s / --syslog — sends error messages to syslog instead of standard error

rmmod vs modprobe -r: When to Use Each

rmmod removes only the module you name. If another loaded module depends on it, rmmod fails with an error.

modprobe -r is the preferred approach for most situations:

bashsudo modprobe -r module_name

It reads the full dependency tree and removes the named module plus any dependent modules that are no longer in use. Removal happens in the correct order, so no module is left in an inconsistent state.

Use rmmod only when you need precise control and you are certain the module has no loaded dependents.

Blacklist a Module and Troubleshoot Common Errors

Blacklisting is how you prevent a module from loading at the next boot. rmmod only removes the module for the current session — it loads again after a reboot unless you blacklist it.

Create a configuration file in /etc/modprobe.d/:

bashsudo nano /etc/modprobe.d/blacklist-custom.conf

Add one module name per line:

blacklist module_name

After saving, regenerate the initramfs to apply the blacklist at boot. On Debian and Ubuntu:

bashsudo update-initramfs -u

On RHEL, Rocky Linux, and AlmaLinux:

bashsudo dracut --force

The initramfs is a compressed filesystem loaded early in the boot process. Without regenerating it, a module already embedded in the current initramfs image can load before the blacklist takes effect.

Common errors:

  • Module is in use — check what depends on it with lsmod | grep module_name. The third column shows the usage count; the fourth lists dependent modules. Remove dependents first, or use modprobe -r
  • Module is not currently loaded — verify the exact module name with lsmod
  • Operation not permitted — run with sudo

Prefer modprobe -r for everyday module removal since it handles dependencies automatically. Use rmmod when you need explicit control with no automatic dependency resolution. Leave a comment below if you run into any issues.

Cyber Defence

Recent Posts

What Is a Data Protection Platform and Why Your Organization Needs One

A data protection platform is a unified system that helps organizations discover, classify, monitor, and…

3 weeks ago

How Swiss Privacy Rules Affect AI Companies Under GDPR

AI companies operating in or around Switzerland face a compliance challenge that most legal teams…

3 weeks ago

Swiss FADP vs EU GDPR: Key Differences for AI and Data Privacy

Two major data privacy laws now govern how organizations handle personal data across Europe; the…

3 weeks ago

Kali Linux Commands Cheat Sheet: Complete Quick Reference

This cheat sheet covers the essential Kali Linux commands every pentester and ethical hacker uses…

2 months ago

What I Wish I Knew Before Learning Malware Analysis and Reverse Engineering

When I first started learning malware analysis and reverse engineering, I thought the hardest part…

2 months ago

git fetch vs git pull: How They Work and When to Use Each

Both git fetch and git pull talk to a remote repository, but they do very different things to your…

2 months ago