System.map (Linux kernel symbol table)

Format and common symbol types

Each non-empty line in System.map typically contains three fields: a hexadecimal address, a single-letter type code, and the symbol name. Type codes indicate the symbol class; common letters include:

• T or t — code in the text (text segment)
• D or d — initialized data
• B or b — uninitialized data (BSS)
• R or r — read-only data
• U — undefined (external reference)
• W — weak symbol

Uses and practical examples

System.map is most often used to translate raw addresses found in kernel logs into human-readable symbol names and approximate locations. When a kernel oops prints a sequence of addresses, matching those addresses against the appropriate System.map reveals which functions or variables were involved. Developers also consult System.map when building or debugging kernel modules to ensure symbol references align with the running kernel build. For deeper source-level mapping, System.map is used together with the unstripped vmlinux file and tools like addr2line.

Relationship to runtime symbols and security notes

System.map shows link-time addresses from the built kernel image. Modern kernel features such as Kernel Address Space Layout Randomization (KASLR) can shift runtime addresses, so System.map addresses may not match live kernel addresses unless relocation is accounted for. For live symbol resolution, the kernel exposes /proc/kallsyms (subject to access restrictions), which reflects runtime addresses. Publishing or exposing System.map for a production kernel can reveal kernel layout information and is sometimes treated as a potential information disclosure.

Locations, generation and limitations

Distributions commonly install a matching System.map file under /boot (for example, named with the kernel version). The file is produced at build time from the vmlinux symbol table (using build tools such as nm or scripts within the kernel build system). If the kernel was stripped or the System.map does not match the running kernel version or configuration, symbol lookups will be incorrect. For reliable debugging, use the System.map that corresponds exactly to the kernel image and build used on the system.

Further reading

For practical guidance on translating kernel addresses and analyzing backtraces consult resources about kernel debugging and tools that work with vmlinux, System.map and crash dumps.