Kernel module version enforcement

Question

Linux can be configured to require that kernel modules be digitally signed. On kernels built for embedded devices and consumer devices (i.e., tablets, smartphones, etc.), I can still see that this leaves a hole open for using modules made for older releases to exploit newer ones if both kernels use the same key. Does Linux provide a facility for refusing to load kernel modules from a different version?

Answer 1

Unless you select CONFIG_MODVERSIONS, the kernel will refuse loading a module that has not been compiled for itself. Also, ensure CONFIG_MODULE_FORCE_LOAD is not selected.