a loadable kernel module

A kernel is a single running program, and normally you cannot add code to a running program. But it would be wasteful to compile every possible driver into one giant kernel that must boot whether or not you own that hardware. A loadable kernel module is a piece of kernel code, compiled separately, that can be slotted into the running kernel on demand and removed later — like adding a new tool to a running machine without shutting it down.

A module is built into a .ko file (kernel object), which is an ELF object containing code plus a small table describing its entry points. When you run insmod or modprobe, the kernel loader copies the module's code and data into kernel address space, resolves its references to symbols the kernel exports (this is dynamic linking, but inside the kernel), and calls the module's init function. From that moment the module's code is just part of the kernel — it runs in kernel mode, shares the one kernel address space, and can call exported kernel functions directly. rmmod calls the module's exit function and unloads it.

Modules matter because they make a kernel modular: distributions ship a small core and load drivers, filesystems, and protocols only when needed, and developers can iterate on a driver without rebooting. The danger is the flip side of the power: a module is NOT sandboxed. It runs with full privilege in the kernel's address space, so a stray pointer in a module can scribble over unrelated kernel memory. There is no protection boundary between a module and the rest of the kernel, which is exactly why a single buggy module can panic the whole machine.