Embodiments of the present disclosure relate to a method, device and computer program product for kernel management. The method comprises: receiving, from a server, a plurality of instances of a kernel module to be loaded into a kernel, the plurality of instances corresponding to a plurality of candidate versions, determining a current version of the kernel in response to the kernel being started or updated, and loading, to the kernel, an instance of the plurality of instances corresponding to the current version. Embodiments of the present disclosure may improve the security of the operating system, meet close-source requirement of a commercial operating system and also simplify the process of the kernel module referring to one or more APIs.