Live kernel patching concepts - patching without rebooting

Live kernel patching applies security patches to a running kernel without rebooting. This lesson covers how it works, the tools, and the trade-offs.

How live patching works

A live kernel patch is a compiled module that replaces specific functions in the running kernel:

• The patch module contains the new function code.
• The kernel redirects calls from the old function to the new one.
• The old function is kept for rollback.
• No reboot required.

The kernel continues running with the patched function. The patch is reversible (uninstall the module).

Tools

• kpatch (RHEL): Red Hat’s live kernel patching. Included in RHEL subscriptions.
• Livepatch (Ubuntu): Canonical’s live patching for Ubuntu.
• kgraft (SUSE): SUSE’s live patching.

Each tool has its own command set, but the concept is the same: apply a patch module to the running kernel.

Use kpatch (RHEL)

# Substitute your own values before running:
PATCH_NAME=kpatch-6_8_0-51

# Install kpatch
sudo dnf install kpatch

# List available patches
sudo kpatch list

# Apply a patch
sudo kpatch install "$PATCH_NAME"

# Verify
sudo kpatch list

# Rollback
sudo kpatch uninstall "$PATCH_NAME"

Live patching vs reboot

When to use live patching

• Critical security: CVE with active exploit. Apply within hours without downtime.
• Highly available workloads: services that cannot tolerate any downtime.
• Rapid response: for the first hours of a critical patch.

When to use traditional reboot

• Non-critical updates: batch the reboot with other maintenance.
• Major changes: live patching does not support major kernel changes.
• Hardware driver updates: live patching does not change drivers.
• First 24 hours: the new kernel needs to “settle” with a real reboot to verify.

Knowledge check