Stop the kernel from silently loading modules you never asked for

Technical Briefing | 8/22/2026

You spend all morning hardening your kernel config, blacklisting obscure filesystems and stripping out unused hardware support. Then you reboot, check lsmod, and find a dozen drivers loaded that weren’t there before. It feels like the kernel is ignoring your blacklist, but it’s usually just udev doing its job too well. This bit me back in the day when a rogue sound driver kept clobbering an I/O controller because they shared a bus id.

Why blacklisting in modprobe.d isn’t enough

The standard approach is dropping a file in /etc/modprobe.d/blacklist.conf. But a blacklist only stops modprobe from loading a module by name. If the kernel detects hardware and asks udev to find a driver, udev doesn’t care about your blacklist; it calls modprobe with a specific alias. The kernel loads it anyway. If you really want a driver gone, you need to tell the kernel to stop trying to load it altogether, or starve it by redirecting the install command to true.

echo 'install usb-storage /bin/true' > /etc/modprobe.d/no-usb-storage.conf

• The blacklist file only prevents manual loading via modprobe, not udev’s automatic discovery
• Overriding the install command with /bin/true effectively turns the load attempt into a no-op
• Check /lib/modules/$(uname -r)/modules.alias to see what names your hardware actually reports
• Verify if your initramfs needs a rebuild after changing module configs

Making sure the change sticks

Once you have forced the driver to empty, check /proc/modules to confirm it’s actually gone. If it’s still showing up, double-check your initramfs. Often, the driver is baked into the early boot image, loading before your root filesystem is even mounted. If that’s the case, you need to update your initramfs configuration to explicitly exclude the module from the image, or it will keep coming back to haunt you every time the system starts.

Next time you find an unwanted driver in your stack, don’t just rely on a simple blacklist entry. Track down the hardware alias in the module map and use the install command to feed the kernel the empty result it needs to move on.