Kernel

The kernel's authority comes from CPU privilege levels. On x86 it runs in ring 0 (supervisor mode), user programs in ring 3; on ARMv8 the equivalents are EL1 and EL0, with hypervisors at EL2. Only privileged code may change page tables, mask interrupts, access I/O ports or reconfigure the CPU, so user space has to cross the boundary through a controlled entry point: on x86-64 the syscall instruction jumps to an address the kernel stored in the LSTAR model-specific register, the kernel validates arguments, copies data across with dedicated helpers (copy_from_user in Linux), performs the work and returns. Interrupts and exceptions such as page faults enter the kernel the same way. Every system call is therefore a trust boundary, and most kernel vulnerabilities are memory-safety errors in code that parses data from user space or from devices.

Architectures differ in how much runs in that privileged space. Linux is monolithic: the scheduler, memory manager, file systems, network stack and device drivers all run in ring 0 in one address space, extensible at runtime with loadable modules. Microkernels such as seL4 or QNX keep only address spaces, threads and inter-process communication in the kernel and push drivers and file systems into user-space servers, trading performance for isolation; seL4 is notable for a machine-checked proof of functional correctness. Windows NT and Apple's XNU are usually described as hybrids, but in practice run most drivers in kernel mode.

That is the main security weakness: any kernel-mode driver has full power. Attackers exploit it through bring-your-own-vulnerable-driver (loading a legitimately signed but flawed driver to gain ring-0 access and kill EDR), and defenders see the other side in incidents like the CrowdStrike Falcon update of 19 July 2024, where a faulty content file processed by a kernel driver crashed about 8.5 million Windows machines. Mitigations include mandatory driver signing and Microsoft's vulnerable-driver blocklist, virtualisation-based security (HVCI, "memory integrity"), KASLR, SMEP and SMAP (preventing the kernel from executing or accessing user pages unexpectedly), kernel page-table isolation added after Meltdown in 2018, and, in Linux, eBPF as a verified in-kernel sandbox so that monitoring tools need not ship custom modules. Rust is now accepted for new Linux kernel drivers.

Operationally, a kernel update normally requires a reboot because the running image cannot simply be replaced; live-patching facilities (kpatch, Livepatch, Windows hotpatch on supported editions) apply limited function-level fixes in memory. Since February 2024 the Linux kernel project has been its own CVE Numbering Authority and assigns CVEs to most bug fixes, which has multiplied the number of kernel CVEs and makes CVE counts a poor measure of risk for distributions and appliances. The kernel should not be confused with the whole operating system: shells, system libraries, the init system and user-space services are outside it, and a GNU/Linux distribution or Windows edition bundles a kernel with all of those.