Textbook of Linux

Also known as: signal 9

SIGKILL (signal 9) forcibly terminates a process. Unlike SIGTERM, it cannot be caught, blocked, or ignored: the kernel destroys the process immediately, with no opportunity for cleanup. For this reason, it is the hammer used when a process is hung, unresponsive, or actively malicious—but it should not be the default, because it leaves no chance to release locks, flush buffers, or close files gracefully.

kill -9 <PID>               # by number
kill -KILL <PID>            # by name
pkill -9 bad-process

A process that cannot be killed by SIGKILL is stuck in uninterruptible sleep (state D in ps)—typically blocked on I/O to a broken device or a hanging NFS mount. SIGKILL is noted against the process, and it dies as soon as it returns from the kernel call. In such cases, the remedy is not another signal but fixing the underlying I/O problem, or rebooting.

Overusing kill -9 is a common beginner habit. Properly handling SIGTERM, waiting a few seconds, and only then escalating to SIGKILL is the right approach. Systemd's stop procedure implements exactly this pattern.