modprobe and lsmod: Managing Kernel Modules

modprobe and lsmod: Managing Kernel Modules
Reading time: About 10 min Difficulty: Intermediate

What You'll Learn

  • How to use lsmod to see which modules are currently loaded
  • How to use modprobe to load and unload modules with their dependencies
  • The practical workflow for modinfo, blacklist, and load-at-boot

Quick Summary

  • See state → lsmod (read-only, formats /proc/modules)
  • Load / remove → modprobe (resolves dependencies; avoid raw insmod / rmmod)
  • Configure → /etc/modprobe.d/*.conf (options, blacklist) and /etc/modules-load.d/*.conf (load at boot)

Assumptions

  • Works the same on Ubuntu and RHEL-family systems
  • Module files live under /lib/modules/$(uname -r)/
  • Loading / removing modules generally requires root (sudo)

What is lsmod?

Conclusion: lsmod is a read-only command that lists currently loaded kernel modules. It simply formats the contents of /proc/modules.

$ lsmod
Module                  Size  Used by
nf_conntrack          172032  2 nf_nat,xt_conntrack
xfs                  2068480  1
vfat                   24576  1

What the columns mean:

  • Module: the module name
  • Size: size in memory (bytes)
  • Used by: the reference count followed by the modules that depend on it

A module whose Used by count is not 0 is in use by others and cannot be removed as-is. Unload the dependents first, or let modprobe -r resolve dependencies for you.

To just check whether a module is loaded, combine it with grep:

$ lsmod | grep nf_conntrack

What can modprobe do?

Conclusion: modprobe loads and unloads modules while automatically resolving dependencies, unlike the lower-level insmod and rmmod.

Load a module

$ sudo modprobe nf_conntrack

Any modules it depends on are loaded first, automatically. You pass only the module name—no .ko path required.

Unload a module (-r)

$ sudo modprobe -r nf_conntrack

-r (--remove) removes the target plus any dependency modules that only it was using. It fails if the module is still in use (non-zero Used by).

Preview what would happen (-n -v)

$ modprobe -n -v nf_conntrack
insmod /lib/modules/6.8.0-106-generic/kernel/net/netfilter/nf_conntrack.ko.zst

-n (--dry-run) does not actually load anything; combined with -v (--verbose) it prints the steps that would run. Useful before doing it for real.

modprobe searches under /lib/modules/$(uname -r)/. A Module not found error often means a version mismatch between the running kernel and the installed modules (for example, a kernel was updated but the system has not been rebooted).

How is it different from insmod / rmmod?

Conclusion: insmod and rmmod operate on a single .ko file directly and do no dependency resolution, so in practice you use modprobe.

Operation Recommended (resolves deps) Low-level (no deps)
Load modprobe mod insmod /path/mod.ko
Unload modprobe -r mod rmmod mod
Naming module name full path (insmod)

insmod does not load dependencies, so it fails with errors like Unknown symbol when they are missing. Use modprobe unless you have a specific reason not to.

Inspecting a module with modinfo

Conclusion: modinfo shows a module's file path, description, dependencies, and configurable parameters—use it to investigate before loading.

$ modinfo nf_conntrack
filename:       /lib/modules/6.8.0-106-generic/.../nf_conntrack.ko.zst
license:        GPL
description:    Netfilter connection tracking core
depends:        nf_defrag_ipv4,nf_defrag_ipv6,libcrc32c
parm:           expect_hashsize:uint

Lines worth noting:

  • depends: dependency modules (what modprobe resolves automatically)
  • parm: parameters you can pass at load time
  • filename: the actual .ko path (confirm it matches the running kernel)

Load with a parameter temporarily:

$ sudo modprobe nf_conntrack expect_hashsize=2048

How do I make parameters or blacklists persistent?

Conclusion: Persistent settings go in /etc/modprobe.d/*.conf—options for parameters and blacklist to suppress auto-loading.

Persist a parameter (options)

/etc/modprobe.d/nf_conntrack.conf:

options nf_conntrack expect_hashsize=2048

Disable a module (blacklist)

When you want to suppress auto-loading of a module (for example, to stop a conflicting driver).

/etc/modprobe.d/blacklist-mymod.conf:

blacklist mymod

blacklist does not stop a module from being loaded as another module's dependency. To block it completely, also add install mymod /bin/true. And to stop a module baked into the initramfs, regenerate it with sudo update-initramfs -u (Debian-family).

Load at boot

List module names (one per line) in /etc/modules-load.d/mymod.conf, and systemd-modules-load.service loads them at boot.

nf_conntrack

What is depmod for?

Conclusion: depmod generates the module dependency map (modules.dep) that modprobe relies on to resolve dependencies.

When you add a new .ko under /lib/modules/$(uname -r)/ or update the kernel, refresh the dependency map.

$ sudo depmod -a

This usually runs automatically during package management (apt / dnf) and kernel updates, so you only run it manually after installing a custom-built module.

Troubleshooting

Conclusion: Most failures are version mismatch, in-use, or insufficient privileges. The error message tells you which.

Symptom Likely cause Fix
Module not found Kernel mismatch / not installed Check uname -r → reboot / depmod -a
Module ... is in use Non-zero Used by Stop dependents, or use modprobe -r (not rmmod)
Operation not permitted Insufficient privileges Add sudo
Unknown symbol in module Unresolved deps (when using insmod) Use modprobe / run depmod -a

Kernel-side errors during load / unload appear in dmesg.

$ sudo dmesg | tail

Summary: separate inspection from action

Conclusion: Inspect with lsmod / modinfo, act with modprobe, and keep persistent settings in /etc/modprobe.d/ and /etc/modules-load.d/.

  • Inspect → lsmod (list) / modinfo (details)
  • Act → modprobe (load) / modprobe -r (remove)
  • Configure → options (parameters) / blacklist (disable) / modules-load.d (at boot)
  • When stuck → narrow it down with dmesg and modprobe -n -v

Next Reading