Kernel Development Roadmap

eBPF allows writing programs that hook into the kernel from user-space without modifying kernel source or loading kernel modules. It is the foundation of modern observability, networking, and security tooling. Your networking and infosec background maps directly — think of eBPF as writing Wireshark-level inspection logic that runs inside the kernel at wire speed.

eBPF programs operate under strict kernel verifier constraints, interact with live systems, and require deep understanding of kernel data structures. Debugging a verifier rejection or a subtle interaction between an eBPF map and a network namespace requires contextual reasoning that AI cannot reliably perform.

Loadable kernel modules let you extend the kernel without touching mainline source. This is where you learn the kernel API: memory allocation, concurrency primitives, device registration, procfs/sysfs interfaces. It is the essential foundation before contributing to any subsystem.

Kernel modules operate in kernel space where a single null pointer dereference causes a kernel panic. They require understanding of locking disciplines, memory models, interrupt contexts, and hardware behavior that AI cannot reliably reason about. Debugging a module that works on one kernel version but oopses on another requires deep contextual knowledge.

Netfilter is the kernel’s packet filtering framework — firewalls, NAT, connection tracking, packet mangling. Your daily work with ISE, ACLs, and network segmentation is the userspace manifestation of what Netfilter does at the kernel level. This is the most natural entry point given your background.

Netfilter code handles live network traffic in interrupt context. A bug does not just crash a program — it can drop all packets for an entire network, create security holes, or corrupt connection tracking state. Understanding how a packet traverses the Netfilter hooks, interacts with conntrack, and gets NATted requires the kind of protocol-level expertise you already have.

Linux Security Modules (LSM) is the kernel framework for access control — SELinux, AppArmor, Landlock. Kernel hardening prevents exploitation of vulnerabilities. Your infosec background gives you the adversarial thinking these subsystems require.

Security requires adversarial reasoning — anticipating what an attacker might do. AI generates plausible-looking security code but misses subtle attack vectors, timing side-channels, and privilege escalation paths. The kernel security community values people who can think like attackers, not just write code.

As of December 2025, Rust is no longer experimental in the Linux kernel. The DRM subsystem is approximately one year from requiring Rust for new drivers. Your existing Rust experience from netapi-tui positions you ahead of most kernel developers.

Writing safe Rust that interfaces with unsafe C kernel code requires understanding both the Rust ownership model and the kernel’s implicit memory management contracts. The kernel Rust ecosystem is new enough that patterns are still being established — this is design work, not boilerplate.

ftrace, perf, tracepoints, kprobes — the kernel’s built-in instrumentation. This is how kernel developers actually debug and optimize. Your interest in perf and Wireshark-level analysis makes this a natural fit.

Covers: process management, scheduling, system calls, memory management, VFS, block I/O, interrupts, synchronization, timers. Read this after getting basic C proficiency.

Covers: sk_buff, routing subsystem, Netfilter, IPsec, IPv4/IPv6, neighboring subsystem, InfiniBand, wireless. This bridges your protocol knowledge directly to kernel internals.

Send a blank email (no subject or body needed) to:

All archives available at lore.kernel.org/

subspace.kernel.org/subscribing.html