linux kernel investigation