Linux kernel

Community

The community of Linux kernel developers comprises about 5000–6000 members. According to the "2017 State of Linux Kernel Development", a study issued by the Linux Foundation, covering the commits for the releases 4.8 to 4.13, about 1500 developers were contributing from about 200–250 companies on average. The top 30 developers contributed a little more than 16% of the code. For companies, the top contributors are Intel (13.1%) and Red Hat (7.2%), Linaro (5.6%), IBM (4.1%), the second and fifth places are held by the 'none' (8.2%) and 'unknown' (4.1%) categories.^[82]

"Instead of a roadmap, there are technical guidelines. Instead of a central resource allocation, there are persons and companies who all have a stake in the further development of the Linux kernel, quite independently from one another: People like Linus Torvalds and I don’t plan the kernel evolution. We don’t sit there and think up the roadmap for the next two years, then assign resources to the various new features. That's because we don’t have any resources. The resources are all owned by the various corporations who use and contribute to Linux, as well as by the various independent contributors out there. It's those people who own the resources who decide..."

Conflict

Notable conflicts among Linux kernel developers:

• In July 2007, Con Kolivas announced that he would cease developing for the Linux kernel.^[83][84]
• In July 2009, Alan Cox quit his role as the TTY layer maintainer after disagreement with Torvalds.^[85]
• In December 2010, there was a discussion between Linux SCSI maintainer James Bottomley and SCST maintainer Vladislav Bolkhovitin about which SCSI target stack should be included in the Linux kernel.^[86] This made some Linux users upset.^[87]
• In June 2012, Torvalds made it very clear that he did not agree with NVIDIA releasing its drivers as closed.^[88]
• In April 2014, Torvalds banned Kay Sievers from submitting patches to the Linux kernel for failing to deal with bugs that caused systemd to negatively interact with the kernel.^[89]
• In October 2014, Lennart Poettering accused Torvalds of tolerating the rough discussion style on Linux kernel related mailing lists and of being a bad role model.^[90]
• In March 2015, Christoph Hellwig filed a lawsuit against VMware for infringement of the copyright on the Linux kernel.^[91] Linus Torvalds made it clear that he did not agree with this and similar initiatives by calling lawyers a festering disease.^[92]
• In April 2021, a team from the University of Minnesota was found to be submitting "bad faith" patches to the kernel as part of its research. This resulted in the immediate reversion of all patches ever submitted by a member of the university. In addition, a warning was issued by a senior maintainer that any future patch from the university would be rejected on sight.^[93][94]
• In February 2025, Hector Martin resigned as maintainer of the Asahi Linux project (that added support for Apple silicon systems to Linux) and related kernel subsystems over disagreements about the use of the Rust programming language in the kernel.^[95]
• In June 2025, the Bcachefs filesystem was creating tension with Torvalds^[96] and in September 2025 it was removed from the Linux kernel starting with version 6.18.^[97]

Prominent Linux kernel developers have been aware of the importance of avoiding conflicts between developers.^[98] For a long time there was no code of conduct for kernel developers due to opposition by Torvalds.^[99] A Linux Kernel Code of Conflict was introduced on 8 March 2015.^[100] It was replaced on 16 September 2018 by a new Code of Conduct based on the Contributor Covenant. This coincided with a public apology by Torvalds and a brief break from kernel development.^[101][102] On 30 November 2018, complying with the Code of Conduct, Jarkko Sakkinen of Intel sent out patches replacing instances of "fuck" appearing in source code comments with suitable versions focused on the word 'hug'.^[103]

Developers who feel treated unfairly can report this to the Linux Foundation Technical Advisory Board.^[104] In July 2013, the maintainer of the USB 3.0 driver Sage Sharp asked Torvalds to address the abusive commentary in the kernel development community. In 2014, Sharp backed out of Linux kernel development, saying that "The focus on technical excellence, in combination with overloaded maintainers, and people with different cultural and social norms, means that Linux kernel maintainers are often blunt, rude, or brutal to get their job done".^[105] At the linux.conf.au (LCA) conference in 2018, developers expressed the view that the culture of the community has gotten much better in the past few years. Daniel Vetter, the maintainer of the Intel drm/i915 graphics kernel driver, commented that the "rather violent language and discussion" in the kernel community has decreased or disappeared.^[106]

Laurent Pinchart asked developers for feedback on their experiences with the kernel community at the 2017 Embedded Linux Conference Europe. The issues brought up were discussed a few days later at the Maintainers Summit. Concerns over the lack of consistency in how maintainers responded to patches submitted by developers were echoed by Shuah Khan, the maintainer of the kernel self-test framework. Torvalds contended that there would never be consistency in the handling of patches because different kernel subsystems have, over time, adopted different development processes. Therefore, it was agreed upon that each kernel subsystem maintainer would document the rules for patch acceptance.^[107]

Codebase

The kernel source code, a.k.a. source tree, is managed in the Git version control system – also created by Torvalds.^[111]

As of 2021^[update], the 5.11 release of the Linux kernel had around 30.34 million lines of code. Roughly 14% of the code is part of the "core," including architecture-specific code, kernel code, and memory management code, while 60% is drivers.

Contributions

Contributions are submitted as patches, in the form of text messages on the Linux kernel mailing list (LKML) (and often also on other mailing lists dedicated to particular subsystems). The patches must conform to a set of rules and to a formal language that, among other things, describes which lines of code are to be deleted and what others are to be added to the specified files. These patches can be automatically processed so that system administrators can apply them in order to make just some changes to the code or to incrementally upgrade to the next version.^[112] Linux is distributed also in GNU zip (gzip) and bzip2 formats.

A developer who wants to change the Linux kernel writes and tests a code change. Depending on how significant the change is and how many subsystems it modifies, the change will either be submitted as a single patch or in multiple patches of source code. In case of a single subsystem that is maintained by a single maintainer, these patches are sent as e-mails to the maintainer of the subsystem with the appropriate mailing list in Cc. The maintainer and the readers of the mailing list will review the patches and provide feedback. Once the review process has finished the subsystem maintainer accepts the patches in the relevant Git kernel tree. If the changes to the Linux kernel are bug fixes that are considered important enough, a pull request for the patches will be sent to Torvalds within a few days. Otherwise, a pull request will be sent to Torvalds during the next merge window. The merge window usually lasts two weeks and starts immediately after the release of the previous kernel version.^[113] The Git kernel source tree names all developers who have contributed to the Linux kernel in the Credits directory and all subsystem maintainers are listed in Maintainers.^[114]

As with many large open-source software projects, developers are required to adhere to the Contributor Covenant, a code of conduct intended to address harassment of minority contributors.^[115][116] Additionally, to prevent offense the use of inclusive terminology within the source code is mandated.^[117]

Programming language

Linux is written in a special C programming language supported by GCC, a compiler that extends the C standard in many ways, for example using inline sections of code written in the assembly language (in GCC's "AT&T-style" syntax) of the target architecture.

In September 2021, the GCC version requirement for compiling and building the Linux kernel increased from GCC 4.9 to 5.1, allowing the potential for the kernel to be moved from using C code based on the C89 standard to using code written with the C11 standard,^[118] with the migration to the standard taking place in March 2022, with the release of Linux 5.18.^[119]

Initial support for the Rust programming language was added in Linux 6.1,^[120] which was released in December 2022,^[121] with later kernel versions, such as Linux 6.2 and Linux 6.3, further improving the support.^[122][123]

Coding style

Since 2002, code must adhere to the 21 rules of the Linux Kernel Coding Style.^[124][125]

Versioning

As for most software, the kernel is versioned as a series of dot-separated numbers.

For early versions, the version consisted of three or four dot-separated numbers called major release, minor release and revision.^[15]: 9 At that time, odd-numbered minor releases were for development and testing, while even numbered minor releases for production. The optional fourth digit indicated a patch level.^[22] Development releases were indicated with a release candidate suffix (-rc).

The current versioning conventions are different. The odd/even number implying dev/prod has been dropped, and a major version is indicated by the first two numbers together. While the time-frame is open for the development of the next major, the -rcN suffix is used to identify the n'th release candidate for the next version.^[126] For example, the release of the version 4.16 was preceded by seven 4.16-rcN (from -rc1 to -rc7). Once a stable version is released, its maintenance is passed to the stable team. Updates to a stable release are identified by a three-number scheme (e.g., 4.16.1, 4.16.2, ...).^[126]

Toolchain

The kernel is usually built with the GNU toolchain. The GNU C compiler, GNU cc, part of the GNU Compiler Collection (GCC), is the default compiler for mainline Linux. Sequencing is handled by GNU make. The GNU Assembler (often called GAS or GNU as) outputs the object files from the GCC generated assembly code. Finally, the GNU Linker (GNU ld) produces a statically linked executable kernel file called vmlinux. Both as and ld are part of GNU Binary Utilities (binutils).

GNU cc was for a long time the only compiler capable of correctly building Linux. In 2004, Intel claimed to have modified the kernel so that its C compiler was also capable of compiling it.^[127] There was another such reported success in 2009, with a modified 2.6.22 version.^[128][129] Support for the Intel compiler has been dropped in 2023.^[130]

Since 2010, effort has been underway to build Linux with Clang, an alternative compiler for the C language;^[131] as of 12 April 2014, the official kernel could almost be compiled by Clang.^[132][133] The project dedicated to this effort is named LLVMLinux after the LLVM compiler infrastructure upon which Clang is built.^[134] LLVMLinux does not aim to fork either Linux or the LLVM, therefore it is a meta-project composed of patches that are eventually submitted to the upstream projects. By enabling Linux to be compiled by Clang, developers may benefit from shorter compilation times.^[135]

In 2017, developers completed upstreaming patches to support building the Linux kernel with Clang in the 4.15 release, having backported support for X86-64 and AArch64 to the 4.4, 4.9, and 4.14 branches of the stable kernel tree. Google's Pixel 2 shipped with the first Clang built Linux kernel,^[136] though patches for Pixel (1st generation) did exist.^[137] 2018 saw ChromeOS move to building kernels with Clang by default,^[138] while Android made Clang^[139] and LLVM's linker LLD^[140] required for kernel builds in 2019. Google moved its production kernel used throughout its datacenters to being built with Clang in 2020.^[141] The ClangBuiltLinux group coordinates fixes to both Linux and LLVM to ensure compatibility, both composed of members from LLVMLinux and having upstreamed patches from LLVMLinux.^{[citation needed]}

Debugging

As with any software, problems with the Linux kernel can be difficult to troubleshoot. Common challenges relate to userspace vs. kernel space access, misuse of synchronization primitives, and incorrect hardware management.^[15]: 364

An oops is a non-fatal error in the kernel. After such an error, operations continue with suspect reliability.^[142]

A panic (generated by panic()) is a fatal error. After such an error, the kernel prints a message and halts the computer.^[15]: 371

The kernel provides for debugging by printing via printk(), which stores messages in a circular buffer (overwriting older entries with newer). The syslog(2) system call provides for reading and clearing the message buffer and for setting the maximum log level of the messages to be sent to the console.^[143] Kernel messages are also exported to userland through the /dev/kmsg interface.^[144]

The ftrace mechanism allow for debugging by tracing. It is used for monitoring and debugging Linux at runtime and it can analyze user space latencies due to kernel misbehavior.^{[145][146][147][148]} Furthermore, ftrace allows users to trace Linux at boot-time.^[149]

kprobes and kretprobes can break into kernel execution (like debuggers in userspace) and collect information non-disruptively.^[150] kprobes can be inserted into code at (almost) any address, while kretprobes work at function return. uprobes have similar purposes but they also have some differences in usage and implementation.^[151]

With KGDB Linux can be debugged in much the same way as userspace programs. KGDB requires an additional machine that runs GDB and that is connected to the target to be debugged using a serial cable or Ethernet.^[152]

Change process

The Linux kernel project integrates new code on a rolling basis. Standard operating procedure is that software checked into the project must work and compile without error.

Each kernel subsystem is assigned a maintainer who is responsible for reviewing patches against the kernel code standards and keeping a queue of patches that can be submitted to Torvalds within a merge window that is usually several weeks.

Patches are merged by Torvalds into the source code of the prior stable Linux kernel release, creating the release candidate (-rc) for the next stable release. Once the merge window is closed, only fixes to the new code in the development release are accepted. The -rc development release of the kernel goes through regression testing and once it is considered stable by Torvalds and the subsystem maintainers, a new version is released and the development process starts over again.^[153]

Mainline Linux

The Git tree that contains the Linux kernel source code is referred to as mainline Linux. Every stable kernel release originates from the mainline tree,^[154] and is frequently published on kernel.org. Mainline Linux has only solid support for a small subset of the many devices that run Linux. Non-mainline support is provided by independent projects, such as Yocto or Linaro, but in many cases the kernel from the device vendor is needed.^[155] Using a vendor kernel likely requires a board support package.

Maintaining a kernel tree outside of mainline Linux has proven to be difficult.^[156]

Mainlining refers to the effort of adding support for a device to the mainline kernel,^[157] while there was formerly only support in a fork or no support at all. This usually includes adding drivers or device tree files. When this is finished, the feature or security fix is considered mainlined.^[158]

Linux-like kernel

The maintainer of the stable branch, Greg Kroah-Hartman, has applied the term Linux-like to downstream kernel forks by vendors that add millions of lines of code to the mainline kernel.^[159] In 2019, Google stated that it wanted to use the mainline Linux kernel in Android so the number of kernel forks would be reduced.^[160] The term Linux-like has also been applied to the Embeddable Linux Kernel Subset, which does not include the full mainline Linux kernel but a small modified subset of the code.^[161]

Linux forks

There are certain communities that develop kernels based on the official Linux. Some interesting bits of code from these forks that include Linux-libre, Compute Node Linux, INK, L4Linux, RTLinux, and User-Mode Linux (UML) have been merged into the mainline.^[162] Some operating systems developed for mobile phones initially used heavily modified versions of Linux, including Google Android, Firefox OS, HP webOS, Nokia Maemo and Jolla Sailfish OS. In 2010, the Linux community criticised Google for effectively starting its own kernel tree:^[163][164]

This means that any drivers written for Android hardware platforms, can not get merged into the main kernel tree because they have dependencies on code that only lives in Google's kernel tree, causing it to fail to build in the kernel.org tree. Because of this, Google has now prevented a large chunk of hardware drivers and platform code from ever getting merged into the main kernel tree. Effectively creating a kernel branch that a number of different vendors are now relying on.^[165]

Today Android uses a customized Linux^[166] where major changes are implemented in device drivers, but some changes to the core kernel code is required. Android developers also submit patches to the official Linux that finally can boot the Android operating system. For example, a Nexus 7 can boot and run the mainline Linux.^[166]

At a 2001 presentation at the Computer History Museum, Torvalds had this to say in response to a question about distributions of Linux using precisely the same kernel sources or not:

They're not... well they are, and they're not. There is no single kernel. Every single distribution has their own changes. That's been going on since pretty much day one. I don't know if you may remember Yggdrasil was known for having quite extreme changes to the kernel and even today all of the major vendors have their own tweaks because they have some portion of the market they're interested in and quite frankly that's how it should be. Because if everybody expects one person, me, to be able to track everything that's not the point of GPL. That's not the point of having an open system. So actually the fact that a distribution decides that something is so important to them that they will add patches for even when it's not in the standard kernel, that's a really good sign for me. So that's for example how something like ReiserFS got added. And the reason why ReiserFS is the first journaling filesystem that was integrated in the standard kernel was not because I love Hans Reiser. It was because SUSE actually started shipping with ReiserFS as their standard kernel, which told me "ok." This is actually in production use. Normal People are doing this. They must know something I don't know. So in a very real sense what a lot of distribution houses do, they are part of this "let's make our own branch" and "let's make our changes to this." And because of the GPL, I can take the best portions of them.^[167]

Long-term support

The latest version and older versions are maintained separately. Most of the latest kernel releases were supervised by Torvalds.^[168]

The Linux kernel developer community maintains a stable kernel by applying fixes for software bugs that have been discovered during the development of the subsequent stable kernel. Therefore, www.kernel.org always lists two stable kernels. The next stable Linux kernel is released about 8 to 12 weeks later.

Some releases are designated for long-term support as longterm with bug fix releases for two or more years.^[169]

Size

Some projects have attempted to reduce the size of the Linux kernel. One of them is TinyLinux. In 2014, Josh Triplett started the -tiny source tree for a reduced size version.^{[170][171][172][173]}

Interfaces

Linux started as a clone of UNIX, and aims toward POSIX and Single UNIX Specification compliance.^[205] The kernel provides system calls and other interfaces that are Linux-specific. In order to be included in the official kernel, the code must comply with a set of licensing rules.^[9][14]

The Linux application binary interface (ABI) between the kernel and the user space has four degrees of stability (stable, testing, obsolete, removed);^[206] The system calls are expected to never change in order to preserve compatibility for userspace programs that rely on them.^[207]

Loadable kernel modules (LKMs), by design, cannot rely on a stable ABI.^[200] Therefore, they must always be recompiled whenever a new kernel executable is installed in a system, otherwise they will not be loaded. In-tree drivers that are configured to become an integral part of the kernel executable (vmlinux) are statically linked by the build process.

There is no guarantee of stability of source-level in-kernel API^[200] and, because of this, device driver code, as well as the code of any other kernel subsystem, must be kept updated with kernel evolution. Any developer who makes an API change is required to fix any code that breaks as the result of their change.^[208]

In-kernel API

There are several internal kernel APIs between kernel subsystems. Some are available only within the kernel subsystems, while a somewhat limited set of in-kernel symbols (i.e., variables, data structures, and functions) is exposed to dynamically loadable modules (e.g., device drivers loaded on demand) whether they're exported with the EXPORT_SYMBOL() and EXPORT_SYMBOL_GPL() macros^[233][234] (the latter reserved to modules released under a GPL-compatible license).^[235]

Linux provides in-kernel APIs that manipulate data structures (e.g., linked lists, radix trees,^[236] red-black trees,^[237] queues) or perform common routines (e.g., copy data from and to user space, allocate memory, print lines to the system log, and so on) that have remained stable at least since Linux version 2.6.^{[238][239][240]}

In-kernel APIs include libraries of low-level common services used by device drivers:

• SCSI Interfaces and libATA – respectively, a peer-to-peer packet based communication protocol for storage devices attached to USB, SATA, SAS, Fibre Channel, FireWire, ATAPI device,^[241] and an in-kernel library to support [S]ATA host controllers and devices.^[242]
• Direct Rendering Manager (DRM) and Kernel Mode Setting (KMS) – for interfacing with GPUs and supporting the needs of modern 3D-accelerated video hardware,^[243] and for setting screen resolution, color depth and refresh rate^[244]
• DMA buffers (DMA-BUF) – for sharing buffers for hardware direct memory access across multiple device drivers and subsystems^{[245][246][247]}
• Video4Linux – for video capture hardware
• Advanced Linux Sound Architecture (ALSA) – for sound cards
• New API – for network interface controllers
• mac80211 and cfg80211 – for wireless network interface controllers^[248][249]

Process management

Linux, as other kernels, has the ability to manage processes including creating, suspending, resuming and terminating. Unlike other operating systems, the Linux kernel implements processes as a group of threads called tasks. If two tasks share the same TGID, then they are called in the kernel terminology a task group. Each task is represented by a task_struct data structure. When a process is created it is assigned a globally unique identifier called PID and cannot be shared^[250][251]

A new process can be created by calling clone^[252] family of system calls or fork system call. Processes can be suspended and resumed by the kernel by sending signals like SIGSTOP and SIGCONT. A process can terminate itself by calling exit system call, or terminated by another process by sending signals like SIGKILL, SIGABRT or SIGINT.

If the executable is dynamically linked to shared libraries, a dynamic linker is used to find and load the needed objects, prepare the program to run and then run it.^[253]

The Native POSIX Thread Library (NPTL)^[254] provides the POSIX standard thread interface (pthreads) to userspace. The kernel isn't aware of processes nor threads but it is aware of tasks, thus threads are implemented in userspace. Threads in Linux are implemented as tasks sharing resources, while if they aren't sharing called to be independent processes.

The kernel provides the futex(7) (fast user-space mutex) mechanisms for user-space locking and synchronization.^[255] The majority of the operations are performed in userspace but it may be necessary to communicate with the kernel using the futex(2) system call.^[214]

As opposed to userspace threads described above, kernel threads run in kernel space.^[256] They are threads created by the kernel itself for specialized tasks; they are privileged like the kernel and aren't bound to any process or application.

Scheduling

The Linux process scheduler is modular, in the sense that it enables different scheduling classes and policies.^[257][258] Scheduler classes are pluggable scheduler algorithms that can be registered with the base scheduler code. Each class schedules different types of processes. The core code of the scheduler iterates over each class in order of priority and chooses the highest priority scheduler that has a schedulable entity of type struct sched_entity ready to run.^{[15]: 46–47} Entities may be threads, group of threads, and even all the processes of a specific user.

Linux provides both user preemption as well as (selectable, up to)^[259][260] full kernel preemption.^{[15]: 62–63} Preemption reduces latency, increases responsiveness,^[261] and makes Linux more suitable for desktop and real-time applications. This comes at a cost of throughput, as work being interrupted worsens cache behavior.^[260]

For normal tasks, by default, the kernel uses the Completely Fair Scheduler (CFS) class^{[needs update]}, introduced in version 2.6.23.^[183] The scheduler is defined as a macro in a C header as SCHED_NORMAL. In other POSIX kernels, a similar policy known as SCHED_OTHER allocates CPU timeslices (i.e, it assigns absolute slices of the processor time depending on either predetermined or dynamically computed priority of each process). The Linux CFS does away with absolute timeslices and assigns a fair proportion of CPU time, as a function of parameters like the total number of runnable processes and the time they have already run; this function also takes into account a kind of weight that depends on their relative priorities (nice values).^{[15]: 46–50}

With user preemption, the kernel scheduler can replace the current process with the execution of a context switch to a different one that therefore acquires the computing resources for running (CPU, memory, and more). It makes it according to the CFS algorithm (in particular, it uses a variable called vruntime for sorting entities and then chooses the one that has the smaller vruntime, - i.e., the schedulable entity that has had the least share of CPU time), to the active scheduler policy and to the relative priorities.^[262] With kernel preemption, the kernel can preempt itself when an interrupt handler returns, when kernel tasks block, and whenever a subsystem explicitly calls the schedule() function.

The kernel also contains two POSIX-compliant^[263] real-time scheduling classes named SCHED_FIFO (realtime first-in-first-out) and SCHED_RR (realtime round-robin), both of which take precedence over the default class.^[257] An additional scheduling policy known as SCHED_DEADLINE, implementing the earliest deadline first algorithm (EDF), was added in kernel version 3.14, released on 30 March 2014.^[264][265] SCHED_DEADLINE takes precedence over all the other scheduling classes.

Real-time PREEMPT_RT patches, included into the mainline Linux since version 2.6, provide a deterministic scheduler, the removal of preemption and interrupt disabling (where possible), PI Mutexes (i.e., locking primitives that avoid priority inversion),^[266][267] support for High Precision Event Timers (HPET), preemptive read-copy-update (RCU), (forced) IRQ threads, and other minor features.^{[268][269][270]}

In 2023, Peter Zijlstra proposed replacing CFS with an earliest eligible virtual deadline first scheduling (EEVDF) scheduler,^[271][272] to prevent the need for CFS "latency nice" patches.^[273] The EEVDF scheduler replaced CFS in version 6.6 of the Linux kernel.^[182]

Synchronization

The kernel has different causes of concurrency (e.g., interrupts, bottom halves, preemption of kernel and users tasks, symmetrical multiprocessing).^[15]: 167

For protecting critical regions (sections of code that must be executed atomically), shared memory locations (like global variables and other data structures with global scope), and regions of memory that are asynchronously modifiable by hardware (e.g., having the C volatile type qualifier), Linux provides a large set of tools. They consist of atomic types (which can only be manipulated by a set of specific operators), spinlocks, semaphores, mutexes,^{[274][15]: 176–198 [275]} and lockless algorithms (e.g., RCUs).^{[276][277][278]} Most lock-less algorithms are built on top of memory barriers for the purpose of enforcing memory ordering and prevent undesired side effects due to compiler optimization.^{[279][280][281][282]}

PREEMPT_RT code included in mainline Linux provide RT-mutexes, a special kind of Mutex that do not disable preemption and have support for priority inheritance.^[283][284] Almost all locks are changed into sleeping locks when using configuration for realtime operation.^{[285][270][284]} Priority inheritance avoids priority inversion by granting a low-priority task that holds a contended lock the priority of a higher-priority waiter until that lock is released.^[286][287]

Linux includes a kernel lock validator called Lockdep.^[288][289]

Interrupts

Although the management of interrupts could be seen as a single job, it is divided into two. This split in two is due to the different time constraints and to the synchronization needs of the tasks whose the management is composed of. The first part is made up of an asynchronous interrupt service routine (ISR) that in Linux is known as the top half, while the second part is carried out by one of three types of the so-called bottom halves (softirq, tasklets, and work queues).^{[15]: 133–137}

Linux interrupt service routines can be nested. A new IRQ can trap into a high priority ISR that preempts any other lower priority ISR.

Memory

The Linux kernel manages both physical and virtual memory. It divides physical memory into zones,^[290] each of which has a specific purpose.

• ZONE_DMA: this zone is suitable for DMA.
• ZONE_NORMAL: for normal memory operations.
• ZONE_HIGHMEM: part of physical memory that is only accessible to the kernel using temporary mapping.

Those zones are the most common, but others exist.^[290]

Linux implements virtual memory with 4 or 5-level page tables.^[291] The kernel is not pageable (meaning it is always resident in physical memory and cannot be swapped to the disk) and there is no memory protection (no SIGSEGV signals, unlike in user space), therefore memory violations lead to instability and system crashes.^[15]: 20 User memory is pageable by default, although paging for specific memory areas can be disabled with the mlock() system call family.

Page frame information is maintained in apposite data structures (of type struct page) that are populated immediately after boot and kept until shutdown, regardless of whether they are associated with virtual pages. The physical address space is divided into different zones, according to architectural constraints and intended use. NUMA systems with multiple memory banks are also supported.^[292]

Small chunks of memory can be dynamically allocated in kernel space via the family of kmalloc() APIs and freed with the appropriate variant of kfree(). vmalloc() and kvfree() are used for large virtually contiguous chunks. alloc_pages() allocates the desired number of entire pages.

The kernel used to include the SLAB, SLUB and SLOB allocators as configurable alternatives.^[294][295] The SLOB allocator was removed in Linux 6.4^[296] and the SLAB allocator was removed in Linux 6.8.^[297] The sole remaining allocator is SLUB, which aims for simplicity and efficiency,^[295] is PREEMPT_RT compatible^[298] and was introduced in Linux 2.6.

Virtual filesystem

Since Linux supports numerous filesystems with different features and functionality, it is necessary to implement a generic filesystem that is independent from underlying filesystems. The virtual file system interfaces with other Linux subsystems, userspace, or APIs and abstracts away the different implementations of underlying filesystems. VFS implements system calls like create, open, read, write and close. VFS implements a generic superblock^[299] and inode block that is independent from the one that the underlying filesystem has.

In this subsystem directories and files are represented by a struct file data structure. When userspace requests access to a file it is returned a file descriptor (non negative integer value) but in kernel space it is a struct file structure. This structure stores all the information the kernel knows about a file or directory.

sysfs and procfs are virtual filesystems that expose hardware information and userspace programs' runtime information. These filesystems aren't present on disk and instead the kernel implements them as a callback or routine that gets called when they are accessed by userspace.

Supported architectures

While not originally designed to be portable,^[18][300] Linux is now one of the most widely ported operating system kernels, running on a diverse range of systems from the ARM architecture to IBM z/Architecture mainframe computers. The first port was performed on the Motorola 68000 platform. The modifications to the kernel were so fundamental that Torvalds viewed the Motorola version as a fork and a "Linux-like operating system".^[300] That moved Torvalds to lead a major restructure of the code to facilitate porting to more computing architectures. The first Linux that, in a single source tree, had code for more than i386 alone, supported the DEC Alpha AXP 64-bit platform.^{[301][302][300]}

Linux is used as the primary operating system on IBM’s Summit supercomputer. In October 2019, all systems on the TOP500 list of the world’s fastest supercomputers ran operating systems based on the Linux kernel,^[72] whereas the first Linux-based supercomputer appeared on the list in 1998.^[303]

Linux has also been ported to various handheld devices such as iPhone 3G and iPod.^[304]

Supported devices

In 2007, the LKDDb project has been started to build a comprehensive database of hardware and protocols known by Linux kernels.^[305] The database is built automatically by static analysis of the kernel sources. Later in 2014, the Linux Hardware project was launched to automatically collect a database of all tested hardware configurations with the help of users of various Linux distributions.^[306]

Live patching

Kernel updates can be applied without rebooting by using live patching technologies such as Ksplice, kpatch and kGraft. Initial support for live kernel patching was merged into the Linux kernel mainline in version 4.0, released on 12 April 2015. The feature, known as livepatch, uses the kernel's ftrace functionality and provides a common infrastructure for hot patches supplied through kernel modules, together with interfaces for userspace management tools. In its initial Linux 4.0 implementation, livepatch support was limited to the x86 architecture and provided basic infrastructure rather than a complete live-patching consistency model.

Security

Kernel bugs present potential security issues. For example, they may allow for privilege escalation or create denial-of-service attack vectors. Over the years, numerous bugs affecting system security were found and fixed.^[307] New features are frequently implemented to improve the kernel's security.^[308][309]

Capabilities(7) have already been introduced in the section about the processes and threads. Android makes use of them and systemd gives administrators detailed control over the capabilities of processes.^[310]

Linux offers a wealth of mechanisms to reduce kernel attack surface and improve security that are collectively known as the Linux Security Modules (LSM).^[311] They comprise the Security-Enhanced Linux (SELinux) module, whose code has been originally developed and then released to the public by the NSA,^[312] and AppArmor^[197] among others. SELinux is now actively developed and maintained on GitHub.^[196] SELinux and AppArmor provide support to access control security policies, including mandatory access control (MAC), though they profoundly differ in complexity and scope.

Another security feature is the Seccomp BPF (SECure COMPuting with Berkeley Packet Filters), which works by filtering parameters and reducing the set of system calls available to user-land applications.^[313]

Critics have accused kernel developers of covering up security flaws, or at least not announcing them; in 2008, Torvalds responded to this with the following:^[314][315]

I personally consider security bugs to be just "normal bugs". I don't cover them up, but I also don't have any reason what-so-ever to think it's a good idea to track them and announce them as something special...one reason I refuse to bother with the whole security circus is that I think it glorifies—and thus encourages—the wrong behavior. It makes "heroes" out of security people, as if the people who don't just fix normal bugs aren't as important. In fact, all the boring normal bugs are way more important, just because there's[sic] a lot more of them. I don't think some spectacular security hole should be glorified or cared about as being any more "special" than a random spectacular crash due to bad locking.

Linux distributions typically release security updates to fix vulnerabilities in the Linux kernel. Many offer long-term support releases that receive security updates for a certain Linux kernel version for an extended period of time.

In 2024, researchers disclosed that the Linux kernel contained a serious vulnerability, CVE-2024-50264, located in the AF_VSOCK subsystem. This bug is a use-after-free flaw, a class of memory corruption issue that occurs when a program continues to use memory after it has been freed.^[316][317] Such flaws are particularly dangerous in the kernel, as they can allow attackers to escalate privileges. The bug was resolved in May 2025.^[318]

Licensing terms

Initially, Torvalds released Linux under a license that forbade any commercial use.^[319] This was changed in version 0.12 by a switch to the GNU General Public License version 2 (GPLv2).^[23] This license allows distribution and sale of possibly modified and unmodified versions of Linux but requires that all those copies be released under the same license and be accompanied by - or that, on request, free access is given to - the complete corresponding source code.^[320] Torvalds has described licensing Linux under the GPLv2 as the "best thing I ever did".^[319]

The Linux kernel is licensed explicitly under GNU General Public License version 2 only (GPL-2.0-only) with an explicit syscall exception (Linux-syscall-note),^[9][12][13] without offering the licensee the option to choose any later version, which is a common GPL extension. Contributed code must be available under GPL-compatible license.^[14][208]

There was considerable debate about how easily the license could be changed to use later GPL versions (including version 3), and whether this change is even desirable.^[321] Torvalds himself specifically indicated upon the release of version 2.4.0 that his own code is released only under version 2.^[322] The terms of the GPL state that if no version is specified, then any version may be used,^[323] and Alan Cox pointed out that very few other Linux contributors had specified a particular version of the GPL.^[324]

In September 2006, a survey of 29 key kernel programmers indicated that 28 preferred GPLv2 to the then-current GPLv3 draft. Torvalds commented, "I think a number of outsiders... believed that I personally was just the odd man out because I've been so publicly not a huge fan of the GPLv3."^[325] This group of high-profile kernel developers, including Torvalds, Greg Kroah-Hartman and Andrew Morton, commented on mass media about their objections to the GPLv3.^[326] They referred to clauses regarding DRM/tivoization, patents, "additional restrictions" and warned a Balkanisation of the "Open Source Universe" by the GPLv3.^[326][327] Torvalds, who decided not to adopt the GPLv3 for the Linux kernel, reiterated his criticism even years later.^[328]

Loadable kernel modules

It is debated whether some loadable kernel modules (LKMs) are to be considered derivative works under copyright law, and thereby whether or not they fall under the terms of the GPL.

In accordance with the license rules, LKMs using only a public subset of the kernel interfaces^[233][234] are non-derived works, thus Linux gives system administrators the mechanisms to load out-of-tree binary objects into the kernel address space.^[14]

There are some out-of-tree loadable modules that make legitimate use of the dma_buf kernel feature.^[329] GPL compliant code can certainly use it. A different possible use case would be Nvidia Optimus that pairs a fast GPU with an Intel integrated GPU, where the Nvidia GPU writes into the Intel framebuffer when it is active. But, Nvidia cannot use this infrastructure because it necessitates bypassing a rule that can only be used by LKMs that are also GPL.^[235] Alan Cox replied on LKML, rejecting a request from one of Nvidia's engineers to remove this technical enforcement from the API.^[330] Torvalds clearly stated on the LKML that "[I] claim that binary-only kernel modules ARE derivative 'by default'".^[331]

On the other hand, Torvalds has also said that "[one] gray area in particular is something like a driver that was originally written for another operating system (i.e., clearly not a derived work of Linux in origin). THAT is a gray area, and _that_ is the area where I personally believe that some modules may be considered to not be derived works simply because they weren't designed for Linux and don't depend on any special Linux behaviour".^[332] Proprietary graphics drivers, in particular, are heavily discussed.

Whenever proprietary modules are loaded into Linux, the kernel marks itself as being "tainted",^[333] and therefore bug reports from tainted kernels will often be ignored by developers.

Firmware binary blobs

The official kernel, that is, Torvalds's git branch at the kernel.org repository, contains binary blobs released under the terms of the GNU GPLv2 license.^[9][14] Linux can also load binary blobs, proprietary firmware, drivers, or other executable modules from the filesystem, and link them into kernel space.^[334]

When necessary (e.g., for accessing boot devices or for speed), firmware can be built-in to the kernel, meaning building the firmware into vmlinux; nonetheless, this is not always a viable option for technical or legal issues (e.g., it is not permitted to do this with firmware that is not GPL compatible, although this is quite common nonetheless).^[335]

Trademark

Linux is a registered trademark of Linus Torvalds in the United States, the European Union, and some other countries.^[336][337] A legal battle over the trademark began in 1996, when William Della Croce, a lawyer who was never involved in the development of Linux, started requesting licensing fees for the use of the word Linux. After it was proven that the word was in common use long before Della Croce's claimed first use, the trademark was awarded to Torvalds.^{[338][339][340]}

Removal of Russian maintainers

In October 2024, during the Russian invasion of Ukraine, kernel developer Greg Kroah-Hartman removed some kernel developers whose email addresses suggested a connection to Russia from their roles as maintainers.^[341][342] Linus Torvalds responded that he did not support Russian aggression and would not revert the patch, insinuating that opponents of the patch were Russian trolls.^[343] James Bottomley, a kernel developer, issued an apology for the handling of the situation and clarified that the action was a consequence of U.S. sanctions against Russia.^[344]