KASLR.

Kernel Address Space Layout Randomization (KASLR) randomizes the kernel base and module load addresses each boot so attackers cannot hardcode kernel symbols for local privilege escalation. It belongs to the Application Security category of cybersecurity.

Kernel Address Space Layout Randomization (KASLR) randomizes the kernel base and module load addresses each boot so attackers cannot hardcode kernel symbols for local privilege escalation.

KASLR extends ASLR into the kernel: the kernel image, modules, vmalloc area, physmap, and stacks are loaded at randomized offsets on every boot. Linux added basic KASLR in 2014, hardened by KAISER/KPTI to mitigate Meltdown, while Windows added it in Vista and refined it through Windows 10. Because the kernel typically runs in a single shared address space, leaking even one kernel pointer often breaks KASLR; researchers have demonstrated cache, TLB, prefetch, and speculative-execution side channels that recover offsets. KASLR is most useful combined with SMEP/SMAP, KPTI, kCFI, and strict /proc and dmesg restrictions to prevent address leaks.

Defences for KASLR typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Kernel ASLR.