When Linux boots, it doesn't load the kernel image at a fixed virtual address. KASLR (Kernel Address Space Layout Randomization) picks a random offset — typically 9 bits of entropy on x86-64, giving 512 possible slots aligned to 2MB boundaries in the __START_KERNEL_map region (0xffffffff80000000). The kernel text base becomes 0xffffffff80000000 + (rand & 0x1ff) * 0x200000. Every reboot, every symbol — schedule(), sys_open(), the syscall table — sits at a different address.

The point: an attacker who finds a kernel bug (say, a controlled write via a driver vulnerability) needs to know where to write. Without KASLR, &modprobe_path was a well-known constant across every machine running the same kernel build. With KASLR, they have to leak the base first.

How the leak-and-derive attack works. Every kernel symbol is at a fixed offset from the kernel base. If you can leak any kernel pointer — from a syscall return value, an uninitialized stack slot, a side channel like Meltdown, or a legitimate interface like /proc/kallsyms when kptr_restrict=0 — you subtract the known offset (from the kernel's System.map) and recover the base. Now every other symbol's address falls out by addition.

Concrete example. On a stock Ubuntu kernel, schedule() might live at offset 0x1a2340 from _text. If /proc/kallsyms shows schedule at ffffffff9d3a2340, then _text = 0xffffffff9d200000. Every other symbol — commit_creds, prepare_kernel_cred, init_cred — is now derivable. That's why kptr_restrict=2 (which shows all kernel pointers as zero to non-root users) is the default on hardened kernels, and why dmesg_restrict=1 hides kernel log messages that historically leaked addresses via oops backtraces.

Rule of thumb: KASLR gives you ~9 bits of entropy on x86-64 (2MB alignment in a 1GB region). That's 512 guesses in the worst case. If your attack can be retried without crashing the kernel (e.g., a probe that returns "did this address fault?" via timing), KASLR falls in seconds. If a wrong guess panics the box, 512 tries is effectively infinite.

The catch KASLR doesn't solve: the kernel is randomized once per boot, not per-process. Any information leak during that boot compromises KASLR for every process until reboot. And FGKASLR (function-granular KASLR) — which shuffles individual functions rather than sliding the whole image — is still not upstream as of 2026, because it breaks live patching and profiling.