A monolithic kernel runs all core services, including device drivers and file systems, in a single large kernel space. This contrasts with microkernels that run many services in user space.
Microkernels keep only essential services such as communication, scheduling, and basic memory management inside the kernel. Other services run in user space to improve modularity and stability.
Microkernels improve stability and security by running most services in user space, so a failure in one service does not crash the entire system. Monolithic kernels run all services in kernel mode, risking system crashes if a service fails.
Hybrid kernels mix monolithic and microkernel features by running some services in kernel mode for performance and others in user space for modularity and stability.
Hybrid kernels are often chosen for real-time systems because they allow critical services to run in kernel mode for speed, while less critical services run in user space to improve reliability and modularity.