{
	"id": "3977b1ad-7533-4b10-8d45-40b7d886ae9a",
	"created_at": "2026-04-06T01:29:15.060221Z",
	"updated_at": "2026-04-10T03:19:56.659409Z",
	"deleted_at": null,
	"sha1_hash": "879e49982458d25bed6b74843860cc912109c5b4",
	"title": "init_module(2) - Linux manual page",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 81869,
	"plain_text": "init_module(2) - Linux manual page\r\nArchived: 2026-04-06 00:09:12 UTC\r\ninit_module(2) System Calls Manual init_module(2)\r\nNAME         top\r\n init_module, finit_module - load a kernel module\r\nLIBRARY         top\r\n Standard C library (libc, -lc)\r\nSYNOPSIS         top\r\n #include \u003clinux/module.h\u003e /* Definition of MODULE_* constants */\r\n #include \u003csys/syscall.h\u003e /* Definition of SYS_* constants */\r\n #include \u003cunistd.h\u003e\r\n int syscall(unsigned long size;\r\n SYS_init_module,\r\n void module_image[size], unsigned long size,\r\n const char *param_values);\r\n int syscall(SYS_finit_module, int fd,\r\n const char *param_values, int flags);\r\n Note: glibc provides no wrappers for these system calls,\r\n necessitating the use of syscall(2).\r\nDESCRIPTION         top\r\n init_module() loads an ELF image into kernel space, performs any\r\n necessary symbol relocations, initializes module parameters to\r\n values provided by the caller, and then runs the module's init\r\n function. This system call requires privilege.\r\n The module_image argument points to a buffer containing the binary\r\n image to be loaded; size specifies the size of that buffer. The\r\nhttps://man7.org/linux/man-pages/man2/init_module.2.html\r\nPage 1 of 7\n\nmodule image should be a valid ELF image, built for the running\r\n kernel.\r\n The param_values argument is a string containing space-delimited\r\n specifications of the values for module parameters (defined inside\r\n the module using module_param() and module_param_array()). The\r\n kernel parses this string and initializes the specified\r\n parameters. Each of the parameter specifications has the form:\r\n name[=value[,value...]]\r\n The parameter name is one of those defined within the module using\r\n module_param() (see the Linux kernel source file\r\n include/linux/moduleparam.h). The parameter value is optional in\r\n the case of bool and invbool parameters. Values for array\r\n parameters are specified as a comma-separated list.\r\n finit_module()\r\n The finit_module() system call is like init_module(), but reads\r\n the module to be loaded from the file descriptor fd. It is useful\r\n when the authenticity of a kernel module can be determined from\r\n its location in the filesystem; in cases where that is possible,\r\n the overhead of using cryptographically signed modules to\r\n determine the authenticity of a module can be avoided. The\r\n param_values argument is as for init_module().\r\n The flags argument modifies the operation of finit_module(). It\r\n is a bit mask value created by ORing together zero or more of the\r\n following flags:\r\n MODULE_INIT_IGNORE_MODVERSIONS\r\n Ignore symbol version hashes.\r\n MODULE_INIT_IGNORE_VERMAGIC\r\n Ignore kernel version magic.\r\n MODULE_INIT_COMPRESSED_FILE (since Linux 5.17)\r\n Use in-kernel module decompression.\r\n There are some safety checks built into a module to ensure that it\r\n matches the kernel against which it is loaded. These checks are\r\n recorded when the module is built and verified when the module is\r\n loaded. First, the module records a \"vermagic\" string containing\r\n the kernel version number and prominent features (such as the CPU\r\n type). Second, if the module was built with the\r\n CONFIG_MODVERSIONS configuration option enabled, a version hash is\r\n recorded for each symbol the module uses. This hash is based on\r\nhttps://man7.org/linux/man-pages/man2/init_module.2.html\r\nPage 2 of 7\n\nthe types of the arguments and return value for the function named\r\n by the symbol. In this case, the kernel version number within the\r\n \"vermagic\" string is ignored, as the symbol version hashes are\r\n assumed to be sufficiently reliable.\r\n Using the MODULE_INIT_IGNORE_VERMAGIC flag indicates that the\r\n \"vermagic\" string is to be ignored, and the\r\n MODULE_INIT_IGNORE_MODVERSIONS flag indicates that the symbol\r\n version hashes are to be ignored. If the kernel is built to\r\n permit forced loading (i.e., configured with\r\n CONFIG_MODULE_FORCE_LOAD), then loading continues, otherwise it\r\n fails with the error ENOEXEC as expected for malformed modules.\r\n If the kernel was build with CONFIG_MODULE_DECOMPRESS, the in-\r\n kernel decompression feature can be used. User-space code can\r\n check if the kernel supports decompression by reading the\r\n /sys/module/compression attribute. If the kernel supports\r\n decompression, the compressed file can directly be passed to\r\n finit_module() using the MODULE_INIT_COMPRESSED_FILE flag. The\r\n in-kernel module decompressor supports the following compression\r\n algorithms:\r\n • gzip (since Linux 5.17)\r\n • xz (since Linux 5.17)\r\n • zstd (since Linux 6.2)\r\n The kernel only implements a single decompression method. This is\r\n selected during module generation accordingly to the compression\r\n method chosen in the kernel configuration.\r\nRETURN VALUE         top\r\n On success, these system calls return 0. On error, -1 is returned\r\n and errno is set to indicate the error.\r\nERRORS         top\r\n EBADMSG (since Linux 3.7)\r\n Module signature is misformatted.\r\n EBUSY Timeout while trying to resolve a symbol reference by this\r\n module.\r\n EFAULT An address argument referred to a location that is outside\r\n the process's accessible address space.\r\nhttps://man7.org/linux/man-pages/man2/init_module.2.html\r\nPage 3 of 7\n\nENOKEY (since Linux 3.7)\r\n Module signature is invalid or the kernel does not have a\r\n key for this module. This error is returned only if the\r\n kernel was configured with CONFIG_MODULE_SIG_FORCE; if the\r\n kernel was not configured with this option, then an invalid\r\n or unsigned module simply taints the kernel.\r\n ENOMEM Out of memory.\r\n EPERM The caller was not privileged (did not have the\r\n CAP_SYS_MODULE capability), or module loading is disabled\r\n (see /proc/sys/kernel/modules_disabled in proc(5)).\r\n The following errors may additionally occur for init_module():\r\n EEXIST A module with this name is already loaded.\r\n EINVAL param_values is invalid, or some part of the ELF image in\r\n module_image contains inconsistencies.\r\n ENOEXEC\r\n The binary image supplied in module_image is not an ELF\r\n image, or is an ELF image that is invalid or for a\r\n different architecture.\r\n The following errors may additionally occur for finit_module():\r\n EBADF The file referred to by fd is not opened for reading.\r\n EFBIG The file referred to by fd is too large.\r\n EINVAL flags is invalid.\r\n EINVAL The decompressor sanity checks failed, while loading a\r\n compressed module with flag MODULE_INIT_COMPRESSED_FILE\r\n set.\r\n ENOEXEC\r\n fd does not refer to an open file.\r\n EOPNOTSUPP (since Linux 5.17)\r\n The flag MODULE_INIT_COMPRESSED_FILE is set to load a\r\n compressed module, and the kernel was built without\r\n CONFIG_MODULE_DECOMPRESS.\r\n ETXTBSY (since Linux 4.7)\r\nhttps://man7.org/linux/man-pages/man2/init_module.2.html\r\nPage 4 of 7\n\nThe file referred to by fd is opened for read-write.\r\n In addition to the above errors, if the module's init function is\r\n executed and returns an error, then init_module() or\r\n finit_module() fails and errno is set to the value returned by the\r\n init function.\r\nSTANDARDS         top\r\n Linux.\r\nHISTORY         top\r\n finit_module()\r\n Linux 3.8.\r\n The init_module() system call is not supported by glibc. No\r\n declaration is provided in glibc headers, but, through a quirk of\r\n history, glibc versions before glibc 2.23 did export an ABI for\r\n this system call. Therefore, in order to employ this system call,\r\n it is (before glibc 2.23) sufficient to manually declare the\r\n interface in your code; alternatively, you can invoke the system\r\n call using syscall(2).\r\n Linux 2.4 and earlier\r\n In Linux 2.4 and earlier, the init_module() system call was rather\r\n different:\r\n #include \u003clinux/module.h\u003e\r\n int init_module(const char *name, struct module *image);\r\n (User-space applications can detect which version of init_module()\r\n is available by calling query_module(); the latter call fails with\r\n the error ENOSYS on Linux 2.6 and later.)\r\n The older version of the system call loads the relocated module\r\n image pointed to by image into kernel space and runs the module's\r\n init function. The caller is responsible for providing the\r\n relocated image (since Linux 2.6, the init_module() system call\r\n does the relocation).\r\n The module image begins with a module structure and is followed by\r\n code and data as appropriate. Since Linux 2.2, the module\r\n structure is defined as follows:\r\nhttps://man7.org/linux/man-pages/man2/init_module.2.html\r\nPage 5 of 7\n\nstruct module {\r\n unsigned long size_of_struct;\r\n struct module *next;\r\n const char *name;\r\n unsigned long size;\r\n long usecount;\r\n unsigned long flags;\r\n unsigned int nsyms;\r\n unsigned int ndeps;\r\n struct module_symbol *syms;\r\n struct module_ref *deps;\r\n struct module_ref *refs;\r\n typeof(int (void)) *init;\r\n typeof(void (void)) *cleanup;\r\n const struct exception_table_entry *ex_table_start;\r\n const struct exception_table_entry *ex_table_end;\r\n #ifdef __alpha__\r\n unsigned long gp;\r\n #endif\r\n };\r\n All of the pointer fields, with the exception of next and refs,\r\n are expected to point within the module body and be initialized as\r\n appropriate for kernel space, that is, relocated with the rest of\r\n the module.\r\nNOTES         top\r\n Information about currently loaded modules can be found in\r\n /proc/modules and in the file trees under the per-module\r\n subdirectories under /sys/module.\r\n See the Linux kernel source file include/linux/module.h for some\r\n useful background information.\r\nSEE ALSO         top\r\n create_module(2), delete_module(2), query_module(2), lsmod(8),\r\n modprobe(8)\r\nCOLOPHON         top\r\nhttps://man7.org/linux/man-pages/man2/init_module.2.html\r\nPage 6 of 7\n\nThis page is part of the man-pages (Linux kernel and C library\r\n user-space interface documentation) project. Information about\r\n the project can be found at\r\n ⟨https://www.kernel.org/doc/man-pages/⟩. If you have a bug report\r\n for this manual page, see\r\n ⟨https://git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/CONTRIBUTING⟩.\r\n This page was obtained from the tarball man-pages-6.16.tar.gz\r\n fetched from\r\n ⟨https://mirrors.edge.kernel.org/pub/linux/docs/man-pages/⟩ on\r\n 2026-01-16. If you discover any rendering problems in this HTML\r\n version of the page, or you believe there is a better or more up-\r\n to-date source for the page, or you have corrections or\r\n improvements to the information in this COLOPHON (which is not\r\n part of the original manual page), send a mail to\r\n man-pages@man7.org\r\nLinux man-pages 6.16 2025-09-07 init_module(2)\r\nPages that refer to this page: create_module(2),  delete_module(2),  get_kernel_syms(2),  query_module(2), \r\nsyscalls(2),  unimplemented(2),  systemd.exec(5),  capabilities(7)\r\nSource: https://man7.org/linux/man-pages/man2/init_module.2.html\r\nhttps://man7.org/linux/man-pages/man2/init_module.2.html\r\nPage 7 of 7",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://man7.org/linux/man-pages/man2/init_module.2.html"
	],
	"report_names": [
		"init_module.2.html"
	],
	"threat_actors": [],
	"ts_created_at": 1775438955,
	"ts_updated_at": 1775791196,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/879e49982458d25bed6b74843860cc912109c5b4.pdf",
		"text": "https://archive.orkl.eu/879e49982458d25bed6b74843860cc912109c5b4.txt",
		"img": "https://archive.orkl.eu/879e49982458d25bed6b74843860cc912109c5b4.jpg"
	}
}