$ uname -sr
What does this kernel actually have?
Every week somebody ships code that calls openat2 and then finds out prod is running a kernel older than their car. Paste uname -sr from the box you care about. You'll get back which of the interfaces in the syscall reference it has, which flags it's missing, and the release that fixes it. It runs in your browser. Nothing gets sent anywhere.
What landed when
Mainline Linux release that first shipped each interface or flag, newest first, read off the man pages cited on each card.
| Interface | What landed | Yours |
|---|---|---|
| Linux 7.2 | ||
| openat2(2)OPENAT2_REGULAR | Open only if the target is a regular file; otherwise fail with EFTYPE. | |
| userfaultfd(2)UFFDIO_REGISTER_MODE_RWP | Notify on any read or write to a present page; can't be combined with MODE_WP. | |
| Linux 6.13 | ||
| process_madvise(2)any advice (self) | When pidfd refers to the calling process, any madvise advice is permitted. | |
| Linux 6.9 | ||
| pidfd_open(2)PIDFD_THREAD | Refer to a specific thread rather than a thread-group leader. | |
| pidfd_send_signal(2)PIDFD_SIGNAL_THREAD | Send the signal to the specific thread referenced by pidfd. | |
| pidfd_send_signal(2)PIDFD_SIGNAL_THREAD_GROUP | If pidfd refers to a thread-group leader, signal the whole thread group. | |
| pidfd_send_signal(2)PIDFD_SIGNAL_PROCESS_GROUP | If pidfd refers to a process-group leader, signal the whole process group. | |
| Linux 6.8 | ||
| statx(2)STATX_MNT_ID_UNIQUE | Mask: request a unique (non-reused) mount ID in stx_mnt_id. | |
| Linux 6.6 | ||
| fsopen(2)FSCONFIG_CMD_CREATE_EXCL | Like FSCONFIG_CMD_CREATE but fail instead of silently reusing an existing matching superblock. | |
| Linux 6.5 | ||
| cachestat(2) | Query page cache status (resident, dirty, writeback, evicted) for a byte range of an open file. | |
| fsopen(2)MOVE_MOUNT_BENEATH | move_mount(): mount beneath the top mount at the target instead of on top of it. | |
| io_uring_setup(2)IORING_SETUP_NO_MMAP | Use caller-allocated memory for the rings instead of mmap(2)-ing kernel memory. | |
| Linux 6.1 | ||
| io_uring_setup(2)IORING_SETUP_DEFER_TASKRUN | Defer completion work until io_uring_enter(2) with GETEVENTS. Requires SINGLE_ISSUER. | |
| statx(2)STATX_DIOALIGN | Mask: request direct I/O alignment limits; support varies by filesystem. | |
| Linux 6.0 | ||
| io_uring_setup(2)IORING_SETUP_SINGLE_ISSUER | Only one task may submit; violations fail with -EEXIST. | |
| Linux 5.19 | ||
| io_uring_setup(2)IORING_SETUP_COOP_TASKRUN | Don't interrupt the task with IPIs on completion; process at the next kernel transition. | |
| Linux 5.18 | ||
| io_uring_setup(2)IORING_SETUP_SUBMIT_ALL | Keep submitting the batch even if one request errors during submission. | |
| Linux 5.17 | ||
| prctl(2)PR_SET_VMA | PR_SET_VMA_ANON_NAME names an anonymous mapping. Max 80 bytes with NUL; printable ASCII except [ ] \ $ `. | |
| Linux 5.15 | ||
| fanotify_init(2)FAN_REPORT_PIDFDLinux 5.15 and 5.10.220 | Attach a pidfd for the process that caused the event, so PID reuse can't fool you. | |
| Linux 5.14 | ||
| madvise(2)MADV_POPULATE_WRITE | Prefault page tables writable, as if writing to each page, without actually writing. | |
| memfd_secret(2) | Create memory removed from the kernel's direct map, mapped only by fd holders. | |
| Linux 5.13 | ||
| landlock_create_ruleset(2) | Create a Landlock ruleset fd, step one of unprivileged filesystem/network sandboxing. | |
| userfaultfd(2)UFFDIO_REGISTER_MODE_MINOR | Notify on minor faults (page in page cache, no PTE); resolve with UFFDIO_CONTINUE. | |
| Linux 5.12 | ||
| openat2(2)RESOLVE_CACHED | Fail with EAGAIN unless every component is already in the lookup cache; retry without it. | |
| Linux 5.11 | ||
| close_range(2)CLOSE_RANGE_CLOEXEC | Set close-on-exec on the range instead of closing the descriptors. | |
| userfaultfd(2)UFFD_USER_MODE_ONLY | Only handle faults originating in user space; kernel-originated faults get SIGBUS. | |
| Linux 5.10 | ||
| io_uring_setup(2)IORING_SETUP_R_DISABLED | Start the ring disabled so restrictions can be registered before submissions are allowed. | |
| pidfd_open(2)PIDFD_NONBLOCK | waitid(2) on the fd returns EAGAIN instead of blocking if the task hasn't terminated. | |
| process_madvise(2) | madvise() for another process's address space, addressed by pidfd and an iovec of ranges. | |
| Linux 5.9 | ||
| close_range(2) | Close, or mark close-on-exec, every file descriptor in a range in one call. | |
| Linux 5.8 | ||
| setns(2)CLONE_NEWTIME | fd must refer to a time namespace. | |
| statx(2)STATX_MNT_ID | Mask: request stx_mnt_id, the ID of the mount containing the file. | |
| Linux 5.7 | ||
| clone3(2)CLONE_INTO_CGROUP | Place the child in the cgroup v2 specified by args.cgroup (a cgroup fd) from the first instruction; no fork-then-move race. | |
| userfaultfd(2)UFFDIO_REGISTER_MODE_WP | Notify on writes to write-protected pages; resolve with UFFDIO_WRITEPROTECT. | |
| Linux 5.6 | ||
| getrandom(2)GRND_INSECURE | Return bytes even before the pool is seeded, with no cryptographic guarantee. Early-boot use only. | |
| openat2(2) | Open a file with kernel-enforced path-resolution constraints (RESOLVE_* flags). | |
| pidfd_getfd(2) | Duplicate a file descriptor out of another process, addressed by its pidfd. | |
| unshare(2)CLONE_NEWTIME | New time namespace; CLOCK_MONOTONIC and CLOCK_BOOTTIME can be offset independently. | |
| Linux 5.5 | ||
| clone3(2)set_tid / set_tid_size | Assign a specific TID in each namespace level listed in args.set_tid. Used by checkpoint/restore tools (CRIU). Requires CAP_SYS_ADMIN in each namespace. | |
| Linux 5.4 | ||
| madvise(2)MADV_COLD | Deactivate the pages so they're likelier reclaim targets. Nondestructive. | |
| madvise(2)MADV_PAGEOUT | Reclaim the pages now: anon goes to swap, dirty file pages get written back. | |
| Linux 5.3 | ||
| clone3(2) | Fork a child process using a struct-based API; write a pidfd atomically with CLONE_PIDFD. | |
| pidfd_open(2) | Get a file descriptor that refers to a process, immune to PID reuse. | |
| Linux 5.2 | ||
| fsopen(2) | Open a filesystem context: step one of the fd-based mount API (fsconfig, fsmount, move_mount). | |
| Linux 5.1 | ||
| fanotify_init(2)FAN_REPORT_FID | Identify objects by file handle instead of an open fd; not allowed with the CONTENT/PRE_CONTENT classes. | |
| io_uring_setup(2) | Create an io_uring instance: shared submission/completion rings for async I/O. | |
| pidfd_send_signal(2) | Send a signal to the process a pidfd refers to, without PID-reuse races. | |
| Linux 5.0 | ||
| seccomp(2)SECCOMP_FILTER_FLAG_NEW_LISTENER | Return a user-space notification fd for SECCOMP_RET_USER_NOTIF. | |
| seccomp(2)SECCOMP_RET_USER_NOTIF | Filter action: hand the decision to a user-space supervisor via the listener fd. | |
| Linux 4.20 | ||
| fanotify_init(2)FAN_REPORT_TID | Report the thread ID instead of the process ID in the event metadata pid field. | |
| Linux 4.19 | ||
| SO_REUSEPORTBPF_PROG_TYPE_SK_REUSEPORT | eBPF program type returning SK_PASS/SK_DROP; selects via bpf_sk_select_reuseport. | |
| Linux 4.18 | ||
| rseq(2) | Register a per-thread struct that the kernel keeps updated with the current CPU ID, enabling lock-free per-CPU data updates via restartable critical sections. | |
| Linux 4.14 | ||
| madvise(2)MADV_WIPEONFORK | Child sees zero-filled memory in this range after fork; cleared on execve. Private anon only. | |
| memfd_create(2)MFD_HUGETLB | Back the file with hugetlbfs huge pages; pick size with MFD_HUGE_2MB, MFD_HUGE_1GB, etc. | |
| seccomp(2)SECCOMP_FILTER_FLAG_LOG | Log all filter actions except SECCOMP_RET_ALLOW. | |
| seccomp(2)SECCOMP_GET_ACTION_AVAIL | Test whether the kernel supports a given filter return action. | |
| seccomp(2)SECCOMP_RET_KILL_PROCESS | Filter action: kill the whole process with a core dump; the syscall is not executed. | |
| seccomp(2)SECCOMP_RET_LOG | Filter action: allow the syscall but log it. | |
| Linux 4.11 | ||
| statx(2) | Extended stat: request specific fields, get birth time, inode attribute flags and mount ID. | |
| userfaultfd(2)UFFD_EVENT_FORK / REMAP / REMOVE / UNMAP | Non-page-fault events about VM layout changes, enabled via UFFDIO_API features. | |
| Linux 4.10 | ||
| userfaultfd(2)UFFDIO_REGISTER_MODE_MISSING | Notify on access to a missing page; resolve with UFFDIO_COPY or UFFDIO_ZEROPAGE. | |
| Linux 4.8 | ||
| pkey_alloc / pkey_mprotect(2) | Allocate a memory protection key and use it to gate access to a memory region via a per-thread register, without a syscall per permission switch. | |
| Linux 4.6 | ||
| setns(2)CLONE_NEWCGROUP | fd must refer to a cgroup namespace. | |
| unshare(2)CLONE_NEWCGROUP | New cgroup namespace; the caller sees its current cgroup as root. | |
| Linux 4.5 | ||
| copy_file_range(2) | Copy a range of bytes between two file descriptors entirely inside the kernel, with server-side offload on NFS 4.2 and reflink on btrfs. | |
| madvise(2)MADV_FREE | Kernel may free the pages lazily under memory pressure; a write before then cancels the free. Private anon only. | |
| Linux 4.4 | ||
| mlock(2)MCL_ONFAULT | With MCL_CURRENT/MCL_FUTURE: lock pages as they're faulted in instead of populating them up front. | |
| mlock(2)MLOCK_ONFAULT | mlock2(): lock resident pages now, the rest of the range when they're first faulted in. | |
| Linux 4.3 | ||
| capset(2)Ambient | Caps kept across execve of unprivileged binaries; always a subset of permitted and inheritable. Set via prctl. | |
| prctl(2)PR_CAP_AMBIENT | Read or change the ambient capability set: RAISE, LOWER, IS_SET, CLEAR_ALL. | |
| userfaultfd(2) | Create an fd that lets userspace resolve page faults on registered memory ranges. | |
| Linux 3.17 | ||
| getrandom(2) | Fill a buffer with random bytes from the kernel CSPRNG, without opening /dev/urandom. | |
| memfd_create(2) | Create an anonymous RAM-backed file with no path, optionally sealable. | |
| seccomp(2) | Set the thread's seccomp state: strict mode or a BPF filter on every syscall. | |
| timerfd_create(2)TFD_IOC_SET_TICKS | ioctl(2) to set the expiration count; for checkpoint/restore. | |
| Linux 3.15 | ||
| timerfd_create(2)CLOCK_BOOTTIME | Like CLOCK_MONOTONIC but keeps counting while the system is suspended. | |
| Linux 3.11 | ||
| timerfd_create(2)CLOCK_REALTIME_ALARM / CLOCK_BOOTTIME_ALARM | Wake the system from suspend; setting requires CAP_WAKE_ALARM. | |
| Linux 3.9 | ||
| SO_REUSEPORT | Let multiple sockets bind one address:port; the kernel spreads traffic across them. | |
| Linux 3.8 | ||
| setns(2)CLONE_NEWNS | Mount namespace. Needs CAP_SYS_CHROOT and CAP_SYS_ADMIN; caller must not share CLONE_FS state. | |
| setns(2)CLONE_NEWPID | Descendant PID namespace. Only affects children created afterwards, not the caller. | |
| setns(2)CLONE_NEWUSER | User namespace. Caller must be single-threaded; needs CAP_SYS_ADMIN in the target namespace. | |
| unshare(2)CLONE_NEWPID | New PID namespace for future children only. The caller stays in its original namespace; the next forked child becomes PID 1 in the new namespace. | |
| unshare(2)CLONE_NEWUSER | New user namespace; unprivileged processes may call this and then write uid_map/gid_map to appear as root inside. | |
| Linux 3.5 | ||
| keyctl(2)KEYCTL_INVALIDATE | Mark a key invalid immediately and schedule it for garbage collection. | |
| prctl(2)PR_SET_NO_NEW_PRIVS | Permanently stop execve from granting privileges (setuid/setgid bits, file caps). Inherited, can't be unset. | |
| Linux 3.4 | ||
| madvise(2)MADV_DONTDUMP | Exclude the range from core dumps; overrides /proc/pid/coredump_filter. | |
| madvise(2)MADV_DODUMP | Undo an earlier MADV_DONTDUMP. | |
| Linux 3.0 | ||
| setns(2) | Move the calling thread into an existing namespace, given an fd for it (or a pidfd). | |
| Linux 2.6.38 | ||
| madvise(2)MADV_HUGEPAGE | Enable transparent huge pages for the range. | |
| Linux 2.6.37 | ||
| fanotify_init(2) | Create an fanotify group: VFS-level file access events with live fds and blockable opens. | |
| Linux 2.6.30 | ||
| eventfd(2)EFD_SEMAPHORE | read(2) returns 1 and decrements by 1 instead of returning and resetting the whole count. | |
| Linux 2.6.28 | ||
| futex(2)FUTEX_CLOCK_REALTIME | Measure the timeout against CLOCK_REALTIME instead of CLOCK_MONOTONIC (for ops that accept it). | |
| Linux 2.6.27 | ||
| eventfd(2)EFD_CLOEXEC | Set close-on-exec on the new descriptor. | |
| eventfd(2)EFD_NONBLOCK | Set O_NONBLOCK; read on zero or write past the max returns EAGAIN. | |
| signalfd(2)SFD_NONBLOCK | Set O_NONBLOCK on the new descriptor. | |
| signalfd(2)SFD_CLOEXEC | Set close-on-exec on the new descriptor. | |
| timerfd_create(2)TFD_NONBLOCK | Set O_NONBLOCK on the new descriptor. | |
| timerfd_create(2)TFD_CLOEXEC | Set close-on-exec on the new descriptor. | |
| Linux 2.6.26 | ||
| capset(2)_LINUX_CAPABILITY_VERSION_3 | Header version for 64-bit capability sets (datap[0] and datap[1]). V2 (2.6.25) was a glitch; V1 is 32-bit. | |
| Linux 2.6.25 | ||
| capset(2)Bounding | Caps file capabilities can grant at exec. Shrink with PR_CAPBSET_DROP (needs CAP_SETPCAP); can't be restored. | |
| futex(2)FUTEX_WAIT_BITSET | FUTEX_WAIT with a bitmask so wakers can target a subset of waiters. | |
| timerfd_create(2) | Create a timer that reports expirations through a readable file descriptor. | |
| Linux 2.6.24 | ||
| unshare(2)CLONE_NEWNET | New network namespace; private network stack, interfaces, routing tables. | |
| Linux 2.6.23 | ||
| SCM_RIGHTSMSG_CMSG_CLOEXEC | recvmsg(2) flag: set close-on-exec on every received descriptor. | |
| Linux 2.6.22 | ||
| eventfd(2) | Create a kernel-backed 64-bit counter fd for wakeups between threads or processes. | |
| futex(2)FUTEX_PRIVATE_FLAG | OR into op when the futex isn't shared between processes; lets the kernel skip cross-process bookkeeping. | |
| signalfd(2) | Accept signals by reading a file descriptor instead of running a handler. | |
| Linux 2.6.19 | ||
| unshare(2)CLONE_NEWUTS | New UTS namespace; hostname and domainname changes are private. | |
| unshare(2)CLONE_NEWIPC | New IPC namespace; SysV IPC objects and POSIX message queues are isolated. | |
| Linux 2.6.18 | ||
| futex(2)FUTEX_LOCK_PI | Priority-inheritance lock: futex word holds the owner TID and the kernel boosts the owner while others wait. | |
| futex(2)FUTEX_UNLOCK_PI | Release a PI futex taken with FUTEX_LOCK_PI. | |
| Linux 2.6.17 | ||
| splice(2) | Move data between a pipe and another fd without copying through userspace. | |
| tee(2) | Duplicate data from one pipe into another without consuming it from the source. | |
| Linux 2.6.16 | ||
| keyctl(2)KEYCTL_SET_TIMEOUT | Expire the key t seconds from now (realtime clock); 0 clears the timeout. | |
| madvise(2)MADV_DONTFORK | Don't make the range available to the child after fork(2). | |
| unshare(2) | Create new namespaces and move the calling process into them without forking. | |
| Linux 2.6.13 | ||
| ioprio_set(2) | Set a thread's I/O scheduling class and priority (ionice is the CLI wrapper). | |
| Linux 2.6.10 | ||
| keyctl(2) | Manipulate the kernel key retention service: read, revoke, time out and link keys and keyrings. | |
| Linux 2.6.7 | ||
| futex(2)FUTEX_CMP_REQUEUE | Wake some waiters and move the rest to a second futex, after checking *uaddr still equals val3. | |
| Linux 2.6 | ||
| futex(2) | Fast userspace locking: wait on or wake threads sleeping on a 32-bit word in memory. | |
| Linux 2.5.8 | ||
| sched_setaffinity(2) | Set the set of CPUs a thread may run on (taskset is the CLI wrapper). | |
| Linux 2.2 | ||
| capset(2) | Raw syscall to set a thread's permitted, effective and inheritable capability sets. | |
| Linux 2.1.57 | ||
| prctl(2) | Per-process/thread control knobs: no_new_privs, dumpable, parent-death signal, VMA names and more. | |
| Linux 2.0 | ||
| flock(2) | Apply or remove an advisory whole-file lock tied to an open file description. | |
| The BSDs | ||
| pledge(2)OpenBSD 5.9 | Restrict the process to named groups of system operations; violations kill it with SIGABRT. | |
| unveil(2)OpenBSD 6.4 | Hide the whole filesystem except the paths you name, with per-path r/w/x/c permissions. | |
| jail(2)FreeBSD 4.0 | Create a FreeBSD jail and lock the current process into it (jail_set/jail_attach for more). | |
Older than Linux, or nobody wrote it down
mlock(2), madvise(2) predate Linux itself (POSIX.1-1996 (SVr4); 4.4BSD), so every kernel you can still boot has them; check the card for flags that came later. SCM_RIGHTS has been around longer than anyone bothered to record, and the man page doesn't give a release, so the checker won't guess.
Why the version number lies
A kernel release is a floor, not a guarantee. Vendor kernels backport features into old version numbers, so an "old" kernel can have a newer interface than this page says. Stable branches pick up fixes too: that's why a few rows list a second, point-release version, and why you should paste the full uname -r, not just the first two numbers. It cuts the other way as well. A syscall can be compiled out (CONFIG_*), left off the LSM list at boot, blocked by a seccomp filter in your container runtime, or fenced by a sysctl like vm.unprivileged_userfaultfd.
The only real test is calling it and reading errno. ENOSYS means the kernel (or a filter pretending to be the kernel) doesn't know the syscall. EINVAL on a flag usually means it knows the syscall but not that flag. Use this page to decide what to probe for, then probe for it at startup and keep a fallback.
Want the data instead of the page? It's at /syscalls.json, one object per interface, same fields as the cards.