Kernel-adjacent describes software that sits very close to the operating system kernel, even if it is not part of the kernel itself. This includes privileged drivers, device services, and other components that can access hardware, memory, or core system functions. Because these layers run with high trust, faults there can cause crashes, freezes, reboots, or subtle corruption instead of a simple application error.
In cyber security, kernel-adjacent code matters because bugs at this level often have outsized impact. Attackers may target drivers or low-level services to gain persistence, evade detection, or escalate privileges, while defenders treat them as high-risk assets that need code signing, careful patching, and compatibility testing. Even non-malicious utilities, such as peripheral control software, can destabilize a machine after an OS update if they rely on kernel-adjacent interfaces. For that reason, security teams monitor these components closely and include them in incident response and rollback planning.