Module signing is a Linux security control that verifies a kernel module’s cryptographic signature before the module is loaded. If the signature is missing, invalid, or not trusted by the kernel’s keyring, the load is blocked. This helps ensure that only approved code can run inside the kernel, where it has high privileges and broad visibility into the host.
It matters because attackers who gain root access often try to load a malicious module to hide processes, network connections, files, or security tools. A signed-module policy raises the bar for that kind of kernel-level persistence and stealth. In real defenses, administrators combine module signing with secure boot, trusted signing keys, and monitoring for unexpected module-load failures or unsigned module attempts. It is not a complete defense, but it is an important control for reducing the risk of rootkits and other kernel implants.