Estimate kernel memory footprint including slab allocations and kernel structures.
Kernel memory — largely invisible to normal process-level monitoring — includes Slab (cache for frequently allocated kernel objects like inodes, dentries and network buffers), KernelStack (per-thread kernel-mode stacks), PageTables (memory mapping structures, which grow with the number and size of process address spaces) and VmallocUsed (virtually contiguous kernel allocations, notably used by kernel modules and some drivers). Summing these from /proc/meminfo approximates total kernel overhead, useful for explaining a RAM gap between 'sum of process RSS' and actual total used memory.
Total kernel memory
kernel_memory = Slab + KernelStack + PageTables + VmallocUsed
Slab caches grow as the kernel allocates more of the objects they hold — commonly dentry and inode caches on servers touching many files, or networking buffers on servers with many concurrent connections. `slabtop` shows a live, sorted breakdown by cache name and size to identify which specific cache is growing.
Yes, under memory pressure most reclaimable slab caches (marked SReclaimable in /proc/meminfo, as opposed to SUnreclaim) are freed automatically, similar to page cache. Some caches remain unreclaimable while actively in use, which is why sustained SUnreclaim growth is a more meaningful signal to investigate than SReclaimable growth.
Each process's virtual address space requires page table entries to map virtual to physical addresses, and processes with many memory mappings (large heaps, many shared libraries, or many threads with separate stacks) need proportionally more page table memory — this is one reason very high process/thread counts carry real, if often overlooked, kernel memory cost.