Abstract: For mitigating the system security vulnerabilities caused by the Linux kernel memory, a new kernel memory monitoring framework is given out. The framework consist of two parts, a core component for capturing memory access using page-fault technology, and handler components for implementing how to deal with the access and reporting results in different cases. Experimental results demonstrate that the proposed framework can be tracking the target kernel memory in the run-time system and report the findings accurately. At the same time, it has little influence on the whole system.