Kernel
Also known as: OS kernel, operating system kernel
The kernel is the central part of an operating system.
It sits between apps and hardware, deciding which program uses the processor, how memory is shared, and how devices such as drives and network cards are accessed. Because it has full control of the computer, a bug or crash in the kernel can bring down the whole system. While users never see the kernel directly, it's why a faulty driver or security tool can cause a blue screen.
Kernel, explained at three levels
At home
The kernel is like an air traffic controller. Apps are planes asking to take off and land, and the kernel decides who gets the runway and when.
At work
Software that runs in the kernel, such as some security tools and drivers, can crash entire systems if it fails.
At home
A blue screen on Windows or a 'kernel panic' on a Mac usually means something went wrong at the kernel level, often a faulty driver or hardware problem.
At work
Kernel mode has full hardware access, while user mode is restricted. Drivers, antivirus engines, and anti-cheat tools often run in kernel mode for visibility, at the cost of stability risk.
At home
Some game anti-cheat software installs kernel-level drivers. In my opinion, it's worth knowing that you're giving that software deep access to your PC.
At work
Stage updates for kernel-level software in rings, require vendors to support phased rollouts, test recovery procedures for unbootable machines, and keep BitLocker recovery keys accessible.
Real-world examples
At home
Sophie's PC started crashing with blue screens after she installed a new graphics driver. Rolling back the driver stopped the kernel crashes.
At work
Jerome runs IT for a Regina hospital network. After the 2024 CrowdStrike outage, he required staged rollouts for any security software running in the kernel.
How it compares
| feature | Kernel mode | User mode |
|---|---|---|
| Access level | Full hardware access | Restricted |
| Crash impact | Whole system | Usually one app |
| Runs | Kernel, drivers | Regular apps |
| Risk | High | Lower |
Kernel code is powerful and risky. User apps are contained.
For analysts
In vendor risk assessments, I'd ask whether software runs at the kernel level and how updates are staged. That one question would have flagged CrowdStrike-style risks.
History & origin
Early operating systems in the 1960s introduced the idea of a protected core. Unix, developed at Bell Labs from 1969, popularized a compact kernel design, and researchers debated 'monolithic' kernels versus smaller 'microkernels' through the 1980s and 1990s, including a famous 1992 online argument between Andrew Tanenbaum and Linus Torvalds. Windows NT in 1993 introduced the kernel still used in Windows today, and macOS uses the XNU kernel derived from NeXT. On July 19, 2024, a faulty CrowdStrike security update running in the Windows kernel crashed about 8.5 million computers worldwide, grounding flights and disrupting hospitals. Microsoft then began work to let security software run outside the kernel. In my view, that outage was the clearest lesson yet in how much power kernel access carries.