The kernel is the core of an operating system that runs with the highest privileges and manages memory, processes, hardware drivers and access to all system resources.
How the kernel works
Modern processors separate code into privilege levels. Applications run in user mode and cannot touch hardware or other programs’ memory directly; they ask the kernel for services through system calls. The kernel and its drivers run in kernel mode (ring 0) with unrestricted access. Well-known kernels include Linux, the Windows NT kernel and Apple’s XNU used in macOS and iOS.
Why the kernel matters for security
Whoever controls the kernel controls the entire system, including the security software running on it. This makes the kernel a prime target:
- Privilege escalation – kernel bugs let a local user or malware gain root or SYSTEM rights. Examples include Dirty COW (CVE-2016-5195) and Dirty Pipe (CVE-2022-0847) in Linux. Such flaws are a standard step in privilege escalation chains and mobile spyware exploits.
- Rootkits – kernel-mode rootkits hide files, processes and network connections from the operating system itself.
- Vulnerable drivers – in “bring your own vulnerable driver” (BYOVD) attacks, ransomware gangs load a legitimately signed but flawed driver to switch off EDR.
Kernel code is also a reliability risk: in July 2024 a faulty update to CrowdStrike’s kernel-level sensor crashed about 8.5 million Windows computers worldwide.
How the kernel is protected
- Exploit mitigations such as kernel ASLR, SMEP/SMAP and stack canaries.
- Mandatory driver signing, Microsoft’s Kernel Patch Protection and the vulnerable driver blocklist.
- Virtualization-based security, where a hypervisor protects critical kernel memory (HVCI).
- Prompt installation of operating system updates, since kernel fixes are often rated important or critical.
