The Linux kernel source is licensed under GPL-2.0 only, with an explicit syscall exception. The kernel documentation treats the system call interface as a clear boundary, so programs that use it to communicate with the kernel do not become subject to GPL requirements for that reason alone. Code inside the kernel is a different matter.
What the kernel documentation says
The kernel's license rules describe the COPYING file as the license for the kernel source as a whole. Individual files may carry a different license if it is compatible with GPL-2.0, and some are dual licensed, for example under a GPL variant plus a permissive license.
User space API headers are marked with a special expression, GPL-2.0 WITH Linux-syscall-note. The documentation explains why: those headers must be includable in any source file that builds an executable running on Linux.
Two different situations
| Situation | What to check |
|---|---|
| A normal application running on Linux | The syscall note and the application's own dependencies |
| A kernel module or driver built for the kernel | The module's license terms and the kernel's GPL-2.0 requirements |
| A distribution of Linux in a device | Obligations from shipping the kernel and other GPL parts |
The first row is where most software sits. The third is where product companies need care, since shipping a device with Linux means shipping GPL code. See GPL source offer when shipping binaries.
Why diligence teams care
Embedded and device companies often ship a Linux based image. A buyer will ask what is in it, which parts are GPL, how source is offered, and whether any kernel modules are proprietary. The answer depends on the facts of the product, and it is a legal question where a module is concerned. Keep records of the kernel version, the configuration and any patches.
Steps for a device maker
- List every component in the shipped image, kernel included.
- Record the license of each, using exact SPDX identifiers.
- Separate GPL parts from permissive ones.
- Keep the corresponding source and build instructions for the GPL parts.
- Document any out of tree modules and their licenses.
About the WITH operator
The WITH operator in an SPDX expression attaches an exception to a license. For how that works, see SPDX WITH exceptions explained.
Safeguard offers SBOM and dependency scanning plus compliance and evidence automation, which can help you keep an inventory and supporting records current. A free scan shows the inventory side.
Quick check
Is the kernel GPL version 2 or 3?
The kernel documentation says GPL-2.0 only, as described in the COPYING file.
Does using Linux mean my app must be open source?
Not for that reason alone, according to the syscall boundary described in the kernel docs. Check your other dependencies, and ask counsel for your case.
Sources
Last reviewed: 19 October 2026.
