The invention belongs to the field of computer safety and provides a method and a device for detecting a hidden loophole and a Linux operating system. The method comprises the following steps of searching all kernel variables in a Linux kernel; establishing relationship information of system calls and the kernel variables according to the time of using the kernel variables by the system calls; calculating the probability that the kernel variables have loopholes according to the relationship information of the kernel variables and the system calls, and determining the hidden loophole of the Linux operating system according to the probability that the kernel variables have the loopholes. Therefore, the method solves the problem that the hidden loophole of the Linux operating system can not be discovered in an early period. For solving the traditional problem that the hidden loophole of the Linux operating system can not be discovered and selecting Linux kernel source code versions analyzed based on different needs, the method and the device for detecting the loophole can support Linux kernels of a plurality of versions.