Memory Management in Linux

First PublishedFeb 22, 2026ByAtif Alam

Linux uses virtual memory: each process has its own address space, and the kernel maps virtual addresses to physical RAM (or swap) via page tables. Paging moves pages between RAM and swap when physical memory is scarce. The OOM (Out-of-Memory) killer can terminate processes when the system is critically low on memory. The kernel also uses RAM for caching (page cache) and buffering (block I/O), which is reclaimable when applications need more memory.

Concepts

• Virtual memory — Addresses used by programs are virtual; the MMU and kernel translate them to physical frames. This enables isolation, overcommit, and swap.
• Paging — Memory is divided into pages (e.g. 4 KiB). Pages can be evicted to swap and brought back on access (demand paging).
• Swap — Backing store (partition or file) for evicted pages. When swap is heavily used and the system is thrashing (constant paging), performance degrades.
• OOM killer — If the kernel cannot satisfy allocations and cannot free enough memory, it may kill processes (often the one using the most memory) to recover.
• Caching and buffering — “Buffers” (block device metadata) and “Cached” (page cache) in free//proc/meminfo are reclaimable; the kernel frees them when applications need RAM.
• Lazy allocation — The kernel can defer allocating physical pages until the process actually touches the memory (e.g. after malloc).

Relevant tools

Tool	Purpose
top, htop	Process list with memory and CPU; sort by memory or CPU.
free	Summary of memory and swap (use free -h for human-readable).
vmstat	Virtual memory stats: free, buff, cache, si/so (swap in/out).
ps	Process list; sort by RSS with ps aux --sort=-rss.
/proc/meminfo	Detailed kernel memory breakdown.
smem, slabtop	Per-process memory; kernel slab usage.
dmesg	Kernel log (OOM messages).
perf, valgrind, strace	Profiling and tracing (I/O vs CPU; allocations).

Using the tools

• Memory and swap summary — Run free -h and check Mem and Swap. available (or free + reclaimable) is a better indicator of free memory than free alone, because “Cached” can be reclaimed.
• Per-process memory — top or htop, sort by memory; ps aux --sort=-rss. For more detail, smem or /proc/<pid>/status.
• Swap and paging — vmstat 1 shows si/so (swap in/out). swapon -s lists swap devices. High si/so with high CPU wait suggests thrashing.
• Buffers/Cached — In free or /proc/meminfo, “Buffers” and “Cached” are reclaimable; the kernel uses them for disk cache and frees them under memory pressure.
• OOM — Check dmesg for “Out of memory” or “Killed process”. Tuning vm.overcommit_memory and vm.overcommit_ratio (or adding swap) can reduce OOMs when appropriate.

Overcommit and demand paging

Linux allows overcommit: the sum of requested memory can exceed physical RAM. Allocation often succeeds immediately (commit), but physical pages are assigned only when the process accesses the memory (demand paging). So a program that “needs” 1 TB can run on a machine with 16 GB RAM as long as it only touches a subset of that address space. If it actually touches more than RAM + swap, the kernel will start paging heavily; if it still cannot satisfy allocations, the OOM killer may run. Settings like vm.overcommit_memory and vm.overcommit_ratio control how much overcommit is allowed.

Swap

Swap extends usable memory by moving rarely used pages to disk. It can be a swap partition or a swap file.

Swap file — Create a file, mark it as swap, then enable it:

# Create file (e.g. 2 GiB)
sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile

To make it permanent, add a line in /etc/fstab (e.g. /swapfile none swap sw 0 0). Use swapoff /swapfile to disable.

• swapon -s — List active swap devices and usage.
• Thrashing — When the system spends most of its time paging (high si/so in vmstat) and becomes very slow, it is thrashing; add RAM or reduce workload.

Identifying I/O vs CPU bound

• CPU bound — Process uses a lot of CPU time; high %CPU in top/htop, low I/O wait.
• I/O bound — Process spends time waiting for disk or network; high I/O wait in top (wa), or high iostat wait, or many blocking syscalls in strace -T.

Useful commands:

• top or htop — Check %CPU and wa (I/O wait).
• iostat -x 1 — Device utilization and %util; high wait time indicates I/O bound.
• pidstat -d 1 — Per-process I/O.
• strace -T -p <pid> — Syscall durations; many long read/write suggest I/O bound.