KernelSU: Android Kernel-Based Root Solution
/KernelSU
KernelSU earns its place if you want root access that lives inside the kernel rather than bolting onto userspace. The App Profile feature is genuinely useful for tightening security, and the module system being systemless means you can modify Android without leaving permanent traces on /system. Skip it if you're on an x86_64 device running a recent kernel — the panic risk is real and documented. For most arm64 Android users on GKI 2.0 kernels, this is a credible Magisk alternative.
What is KernelSU?
KernelSU is a kernel-based root solution for Android that intercepts at the kernel layer instead of patching userspace. It provides a su binary that operates with kernel-level awareness, giving it the ability to enforce root access policies that userspace tools simply cannot override. The architecture uses a kernel module combined with a userspace component, with a module system that modifies the system without touching system partitions.
Key Features of KernelSU
- ✓Kernel-based su binary — root operations are enforced at kernel level, not userspace
- ✓App Profile — cage root access per app, limiting what apps can do with root privileges
- ✓Systemless module system via metamodules — modify Android without touching /system partitions
- ✓Supports GKI 2.0 (kernel 5.10+) out of the box; older kernels 4.14+ require manual kernel builds
- ✓Works with WSA, ChromeOS, and container-based Android environments
- ✓Dual architecture support: arm64-v8a and x86_64
- ✓GPL-3.0 licensed (kernel module portion is GPL-2.0-only)
What you can do with KernelSU
- •Root an Android device with fine-grained per-app root access policies
- •Install systemless mods on Android without modifying the system partition
- •Add root to WSA (Windows Subsystem for Android) for development or customization
- •Enable root on ChromeOS devices running Android containers
- •Build custom Android distributions with kernel-level root enforcement
- •Restrict root access to specific apps while keeping other apps from seeing it
Installing KernelSU
KernelSU requires patching the kernel directly, which means it is not a simple APK install like Magisk. For GKI 2.0 devices (kernel 5.10+), you can flash a prebuilt KernelSU boot image. For older kernels (4.14+), you must patch and rebuild your kernel manually with the KernelSU kernel module. The process involves flashing the patched boot image and then installing the KernelSU Manager app. Full installation instructions are available at kernelsu.org/guide/installation.html.
Strengths
- ✓App Profile feature genuinely limits root power per app — Magisk has no equivalent
- ✓Systemless module system avoids /system modifications, simplifying OTA updates
- ✓Kernel-level enforcement of root policies cannot be bypassed by userspace tweaks
- ✓Officially supports WSA and ChromeOS alongside traditional Android devices
- ✓Open source with clear GPL licensing — no hidden proprietary components
- ✓Actively maintained with a large user base and community support via Telegram
KernelSU Requirements and Limitations
- △Requires kernel patching — not a simple APK flash for most devices
- △Recent kernels on x86_64 cause KernelSU to fail and potentially trigger a kernel panic (officially documented as a breaking change)
- △Older kernels (pre-5.10) require manual kernel compilation to add KernelSU support
- △Not universally compatible — only supports arm64-v8a and x86_64 architectures
- △GKI 2.0 requirement means non-GKI devices need significantly more effort
- △x86_64 support is actively at risk due to upstream kernel changes breaking compatibility
Alternatives to KernelSU
Frequently Asked Questions
KernelSU officially supports any Android device running a GKI 2.0 kernel (5.10 or higher). Devices with older kernels (4.14+) are supported but require manual kernel compilation to patch in KernelSU. Both arm64-v8a and x86_64 architectures work, though x86_64 has a known breaking issue on recent kernels.
Yes — KernelSU explicitly supports WSA alongside traditional Android devices. Since WSA runs Android in a container on Windows, KernelSU can root that environment through its kernel-level approach, making it useful for developers who want root access inside WSA.
KernelSU's App Profile feature lets you restrict what each app can do with root — something Magisk cannot enforce from userspace. However, 'safer' depends on your threat model. Magisk has been battle-tested across millions of devices for years, while KernelSU is younger and has had x86_64 stability issues with recent kernels.
KernelSU modules are built on a metamodule architecture — they inject modifications into the Android system without touching the /system partition. Modules are installed through the KernelSU Manager app, and they apply their changes at boot. This systemless approach means modules survive OTA updates and leave no permanent traces on system partitions.
Magisk roots Android by injecting into Zygote (a userspace process), while KernelSU operates at the kernel layer. This gives KernelSU the ability to enforce root access policies that userspace cannot bypass. Magisk has a larger module ecosystem and works without kernel modification; KernelSU requires patching the kernel but offers finer-grained root control.
Yes — GKI 2.0 (Generic Kernel Image, kernel 5.10+) is the officially recommended target for KernelSU. On GKI 2.0 devices, you can flash a prebuilt KernelSU boot image without rebuilding your kernel. Older kernels down to 4.14 are supported but require manual kernel patching and recompilation.
The problem it solves
Traditional root solutions like Magisk work in the userspace Daemon (Zygote) and inject via Zygote forks, which means root access is available broadly once granted. Modifications to the system often require touching the system partition — making OTA updates harder and leaving traces that detection tools can find.
Who should try it — and who should skip
Try KernelSU if you run Android on GKI 2.0 kernels (5.10+), especially on WSA or ChromeOS, and you want kernel-level root enforcement with per-app cage controls. Developers building custom Android ROMs will appreciate the systemless module system and clean GPL licensing. Skip it if you need broad device compatibility, are on an x86_64 system with a recent kernel, or want the massive Magisk module ecosystem — Magisk is still the more battle-tested choice for most phone users.
Related repositories
Curious whether KernelSU is right for you?
Let ChatGPT, Claude, or Perplexity look into it — click below and see what AI actually says about KernelSU.