operating system Kali Linux is the de facto standard for information security professionals and pentesters, but working with wireless adapters is often fraught with difficulties. Sometimes, modules built into the kernel conflict with external ones. ath9k or rtl8812au, making it impossible to put the card into monitor mode or run a packet scan. In such situations, the only correct solution is to completely clear the system of old or conflicting components before installing the latest software version.
Uninstalling drivers on Debian-based distributions requires careful attention, as removing critical packages can lead to loss of network access to the machine itself. You must clearly understand the difference between deleting configuration files, clearing the package manager cache, and directly removing kernel modules. Incorrect actions can leave the system unable to connect to the network, requiring recovery via console or Live USB.
In this guide, we will go through all the steps of working with the package manager. apt and kernel module management utilities. You'll learn how to identify installed drivers, safely remove their remnants, and prevent automatic reinstallation of updates that could further disrupt your hardware. We'll pay special attention to working with DKMS, as this mechanism often causes problems when compiling external drivers for WiFi adapters.
Identifying installed network modules
Before proceeding with the removal, it is necessary to determine exactly which drivers are currently active and which packages are responsible for their operation. Kali Linux Modules are loaded automatically at system startup, and often a single physical adapter can be controlled by multiple potential drivers. Let's start by using the utility lspci or lsusb depending on the connection type of your network interface.
Enter the command to view connected USB devices, as most external adapters for pentesting are connected through this port. The output will show the Vendor ID and Product ID, which will help you identify the chipset manufacturer, for example, Realtek, Atheros or RalinkThis data is critical for finding the corresponding package in repositories.
lsusb | grep -i wirelessNext, you should check which kernel modules are currently loaded. The command lsmod will display a list of all active modules, and you'll need to filter it to find network drivers. Pay attention to the "Size" and "Used by" columns, as they indicate dependencies: if a module is being used by other processes, removing it may cause an error or system freeze.
lsmod | grep -E'wl|ath|rtl|iwl'For a more in-depth analysis, you can use the utility hwinfo, which provides detailed information about the driver and the kernel module used. This is especially useful when standard commands don't provide a complete picture of which Debian package provides a given functionality.
⚠️ Attention: Do not remove modules marked as
cfg80211ormac80211These are the core wireless libraries in Linux, and removing them will render any WiFi hardware on the system completely inoperable.
After collecting information about the hardware and active modules, compare the obtained data with the package names. It often happens that a module rtl8812au provided by a package with a similar but not identical name, such as realtek-rtl88xxau-dkmsKnowing the exact package name is the key to a successful and clean uninstall.
Removing drivers via the APT package manager
The main software management tool in Kali Linux is aptTo properly uninstall a driver, simply deleting the executable file isn't enough; it's necessary to remove entries from the package database and clean up the configuration files. The standard uninstall command leaves behind configuration files that may conflict with newer versions of the software.
Use the flag --purge or a team remove followed by a cleanup to ensure complete removal of files. If you installed the driver from the official Kali repositories, the process will go smoothly. However, if the packages were installed manually via dpkg, an additional step will be required to remove installation status records.
sudo apt purge driver-package-nameAfter running the uninstall command, it is recommended to run an automatic system cleanup of unused dependencies. Package manager apt It can track which libraries were installed specifically for the remote driver and offer to remove them. This helps keep the system clean and saves disk space.
- 🧹 Complete
sudo apt autoremoveto remove orphaned packages. - 🗑️ Use it
sudo apt autocleanto clear the cache of old versions of deb packages. - 📦 Check the list of installed packages with the command
dpkg -l | grep name, to ensure success.
In some cases, the system may prompt you to keep or replace configuration files when updating or removing related packages. Always choose the option to remove or replace with the default version if you want to completely reset the driver settings. Keeping old configurations only makes sense when rolling back versions, not for a complete cleanup.
☑️ APT Removal Checklist
Working with DKMS modules and external drivers
Many modern WiFi adapters require drivers to be compiled directly on the target machine due to the lack of support in the main Linux kernel. This is achieved using a mechanism DKMS (Dynamic Kernel Module Support), which automatically rebuilds modules when updating the kernel. Removing such drivers has its own specifics and requires editing the DKMS database.
If you simply delete the driver files from your home directory, DKMS will continue to consider the module installed and attempt to load it the next time you start it. This will result in log errors and potential network failures. You must first remove the module from the DKMS registry before deleting the source code.
sudo dkms remove -m module-name -v module-version --allAfter unregistering the module, you can safely delete the directories with the source code, which are usually located in /usr/srcIt's also worth checking the contents. /lib/modules/$(uname -r)/kernel/drivers/net/wirelessto ensure that compiled objects (.ko files) have been removed. If any files remain, they can be removed manually, but only after stopping the associated services.
⚠️ Attention: When uninstalling DKMS drivers, make sure you don't affect modules required for a wired (Ethernet) connection if you're working remotely. Losing network access may prevent the necessary components from loading.
A situation often arises when the driver was installed via an installation script (for example, for Realtek RTL8812AU), and there is no separate deb package on the system. In this case, the installation script usually creates its own uninstallation script. Check the directory where you cloned the GitHub repository for the file uninstall.sh or similar.
What should I do if dkms remove returns an error?
If the DKMS module removal command returns an error stating that the module is not found, first try running the dkms uninstall command. If that doesn't help, check the status with the dkms status command. It's possible that the module has already been removed from the registry, but the files remain on the disk. In this case, the safest option is to reboot into Recovery Mode and delete the files manually, ensuring that the module is not loaded into memory.
Clearing kernel and module configuration
Even after removing packages, Linux may attempt to load a specific driver at startup if it's listed in module configuration files. This often happens if you previously blacklisted the module or, conversely, forced its loading. Checking these files is a mandatory step in a complete cleanup.
The main configuration file that controls the loading of modules is located at /etc/modprobe.d/. Files with names like blacklist.conf or specific configs created by driver installers (for example, rtl8812au.conf). You need to open these files and delete the lines related to the driver you are removing.
sudo nano /etc/modprobe.d/blacklist.confLook for lines starting with blacklist or installIf you're removing a driver because it conflicts, you may have previously blacklisted it but now want to install a different one. Or, the opposite situation: you need to remove the block on loading. In the context of a complete removal, we remove all references to a specific module so that the kernel can decide for itself what to load (or not load anything).
It's also worth checking the file /etc/modules, where modules are sometimes added for forced loading. If the name of your driver you want to remove is there, delete this line. After making changes to the configuration files, you must update the initramfs so that the changes are applied early in the system boot process.
sudo update-initramfs -uPrevent automatic driver installation
One of the annoying features Kali Linux and other Debian-based distributions is the automatic installation of recommended packages. When you update the system or kernel, the package manager may notice a missing driver for your hardware and automatically install it again, negating any previous removal efforts.
To prevent this, you can use package pinning or create local APT rules. The simplest way is to create a configuration file that assigns a priority of -1 (negative) to a specific package, disallowing its installation. This is more effective than simply keeping the package on the removal list.
Create a file /etc/apt/preferences.d/no-auto-wifi-drivers and add rules there for packages you don't want to see on the system. For example, if you want to prevent the installation of a proprietary Broadcom driver, the rule would look like this. This ensures that even when running apt upgrade the conflicting package will not be affected.
| Plastic bag | Priority | Result |
|---|---|---|
| firmware-brcm80211 | -1 | Installation is prohibited |
| realtek-rtl88xxau-dkms | -1 | Installation is prohibited |
| linux-firmware | 100 | Allowed (basic) |
An alternative method is to use the command apt-mark holdIt freezes the current version of a package or prevents its installation if the package isn't yet installed but is marked as a candidate. However, the preferences.d method is more flexible and allows for fine-tuning the behavior for different repositories.
⚠️ Attention: Be careful when blocking packets containing the word
firmwarewithout specifying the model. General package blockinglinux-firmwareThis may cause other devices, such as Bluetooth or a sound card, to stop working after updating the kernel.
Diagnostics and verification of results
After completing all cleaning procedures and rebooting the system, you need to ensure that the removal was successful and did not affect the stability of the OS. Initial diagnostics begin with checking the list of loaded modules. If the output lsmod There is no name of the removed driver, which means the kernel has not activated it.
Next, you should check whether the system sees the physical device. The command iwconfig or more modern ip link will show the presence of wireless interfaces. If the interface disappears completely, this could be the goal (if we were resolving a conflict) or the problem (if a driver was needed). If the device is identified as unknown, this indicates the proprietary driver has been successfully removed, and an alternative can now be installed.
- 🔍 Check kernel logs:
dmesg | grep -i firmwarewill show microcode loading errors. - 📡 Make sure the interface is not raised:
ip link showshould not show the interface in the UP state. - 🛠️ Testing: Try running
airmon-ngto ensure there are no conflicts with any remaining processes.
An important indicator of a system's cleanliness is the absence of errors in the logs when starting network services. Use journalctl -u NetworkManager or systemctl status wpa_supplicant To analyze the operation of network daemons. If the logs show no messages about failed to load module or missing firmware for the remote device, the procedure is complete.
Frequently Asked Questions (FAQ)
Can I uninstall the WiFi driver if I am using a wireless connection?
Technically, you can run the uninstall command, but as soon as the kernel module is unloaded, your network connection will be immediately disconnected. You'll lose access to the remote machine (SSH, VNC). Always perform such operations either locally at the console or with guaranteed access via a wired Ethernet interface.
What should I do if the system won't boot after removing the driver?
If removing a critical module causes a kernel panic during boot, you'll need a bootable USB flash drive with a live image of Kali or any other Linux distribution. Use it to mount your system's root partition, chroot into it, and reinstall the package. kali-linux-core or a specific driver, or roll back changes to configuration files.
How to distinguish a driver from firmware?
A driver is a kernel software module (usually .ko files) that controls the device. Firmware is the binary microcode files that are loaded into the device's memory during initialization. You need to remove the driver (packages like dkms or modules), while firmware files are usually located in /lib/firmware and are deleted only together with the package linux-firmware, which is not recommended.
Do I need to reboot after each package removal?
Not necessarily after each step, but definitely after the entire cleanup procedure is complete before checking the results. The Linux kernel does not unload actively used modules on the fly without a command. rmmod, but library and configuration files are updated only after a restart. To ensure a clean state, a reboot is required.
Where can I find older driver versions if the new ones don't work?
Kali's official repositories only store the most current versions. To find older versions, you can use the Debian package archive (snapshot.debian.org) or the driver authors' GitHub repositories (for example, aircrack-ng or the official Realtek repos), which often contain versions for specific kernel versions.