Inspect Linux Kernel Modules Safely with modinfo

modinfo reads a kernel module's metadata without loading, unloading or touching it in any way. This guide finds a module, reads its full details, extracts one field for a script, and checks modules for a kernel that is not currently running. Allow about ten minutes for a first investigation.

Before you start

You need a Linux shell and the kmod package. The examples below use kmod version 31 and kernel 6.8.0-139-generic, as installed on the reference machine. Output is host-specific: module descriptions, parameters and file paths depend on the kernel packages installed on your system.

Check the binary and its version without elevated privileges:

$ command -v modinfo
/usr/sbin/modinfo
$ modinfo --version
kmod version 31
+ZSTD +XZ -ZLIB +LIBCRYPTO -EXPERIMENTAL

The feature line can differ between builds. It is the first checkpoint: if modinfo is missing, install kmod through your normal package-management process. Do not use sudo merely to read module metadata.

1. Read a module's full metadata

Pass a module name without the .ko filename extension. modinfo searches the module directory for the selected kernel, which defaults to the running kernel:

$ modinfo loop
filename:       /lib/modules/6.8.0-139-generic/kernel/drivers/block/loop.ko.zst
license:        GPL
description:    Loopback device support
author:         Theodore Ts'o
srcversion:     ...
alias:          block-major-7-*
depends:
retpoline:      Y
intree:         Y
name:           loop
vermagic:       6.8.0-139-generic SMP preempt mod_unload modversions
parm:           max_loop:Maximum number of loop devices (int)
parm:           max_part:Maximum number of partitions per loop device (int)
parm:           async_probe:Use async probe (bool)

Your exact fields and values may differ, and a module can have several parm, alias or depends lines. The filename is printed like a field even though it identifies the module file rather than metadata stored inside it.

Checkpoint: confirm the selected file belongs to the kernel you intended:

$ modinfo -n loop
/lib/modules/6.8.0-139-generic/kernel/drivers/block/loop.ko.zst

The -n shortcut asks only for the filename. It is equivalent to --field filename.

2. Extract one field for a human or script

Use -F or --field when the surrounding labels would get in the way. Field names are case-insensitive. This is useful for a quick check:

$ modinfo -F description loop
Loopback device support
$ modinfo -F license loop
GPL

Some modules do not provide every field. A blank result is not proof that the module is absent, so check the exit status and filename separately when writing automation. Fields such as parm, alias and depends can occur more than once, with one value on each output line.

For example, list the parameters without parsing the complete report:

$ modinfo -F parm loop
max_loop:Maximum number of loop devices (int)
max_part:Maximum number of partitions per loop device (int)
async_probe:Use async probe (bool)

Do not confuse this with changing a parameter. modinfo only reports what the module metadata says. Loading a module with parameters is a separate operation and may affect the running kernel.

3. Make field output safe for scripts

Normal field output uses a newline between values. A newline can theoretically occur inside a field, so use -0 or --null when a script must distinguish records reliably:

$ modinfo --null --field alias loop | while IFS= read -r -d '' alias; do
>     printf 'alias=%s\n' "$alias"
> done
alias=block-major-7-*

The ASCII zero character separates values. It is not normally visible in a terminal, but tools that understand NUL-delimited input can process it without treating an embedded newline as a new record. Keep the command's output and the script's parsing contract aligned.

4. Inspect a module for another installed kernel

Use -k when you need information about a kernel other than the one currently running. This is useful after installing a new kernel, before building an initramfs:

$ ls -d /lib/modules/*
/lib/modules/6.8.0-139-generic
/lib/modules/6.8.0-140-generic
$ modinfo -k 6.8.0-140-generic -F filename loop
/lib/modules/6.8.0-140-generic/kernel/drivers/block/loop.ko.zst

Replace the example version with a directory that actually exists. The option selects the module set to inspect; it does not boot that kernel and does not change the running system. If the directory is under a protected location, ask an administrator for read access rather than changing permissions casually.

If the module tree is staged below another root, add -b or --basedir. For example, a tree mounted at /mnt/new-root is queried like this:

$ modinfo -b /mnt/new-root -k 6.8.0-140-generic -F filename loop
/mnt/new-root/lib/modules/6.8.0-140-generic/kernel/drivers/block/loop.ko.zst

The base directory is / by default. The directory must contain the expected lib/modules/VERSION layout. This command still only reads files.

5. Diagnose a failed lookup

If a name cannot be resolved, check the installed module directories and try the actual path. A module name lookup is not the same as searching every file on disk:

$ modinfo definitely-not-a-module
modinfo: ERROR: Module definitely-not-a-module not found.
$ find /lib/modules/"$(uname -r)" -type f -name 'loop.ko*'
/lib/modules/6.8.0-139-generic/kernel/drivers/block/loop.ko.zst

When you already have a module filename, pass that path directly:

$ modinfo /lib/modules/"$(uname -r)"/kernel/drivers/block/loop.ko.zst | head -5
filename:       /lib/modules/6.8.0-139-generic/kernel/drivers/block/loop.ko.zst
license:        GPL
description:    Loopback device support
author:         Theodore Ts'o

Do not infer that a missing module should be loaded, copied or rebuilt. First confirm the kernel version, the module-tree path and the package installation. Loading, unloading, or rebuilding modules can disrupt services and needs a separate change plan.

Done means