Live kernel patching — kpatch, kgraft, and livepatch

Live kernel patching applies security fixes to the running kernel without rebooting. The mechanism: replace a function in the running kernel with a patched version, using the kernel’s ftrace infrastructure to redirect calls.

How live patching works

flowchart LR
  K[Running kernel]
  F[ftrace hook]
  P[Patched function]
  K --> F
  P -.replaces.-> F

The live-patch daemon (kpatch, kgraft, or canonical-livepatch) loads a specially-built kernel module that uses ftrace to redirect specific kernel functions to their patched versions. The running processes see the patched behaviour; the underlying kernel version does not change.

$ kpatch list; uname -r; cat /proc/version

Installed patches:
kpatch-6.1.0-1.el9_1.x86_64 (kernel-6.1.0-1.el9)
6.1.0-1.el9
Linux version 6.1.0-1.el9 ...

The vendors

$ canonical-livepatch status

current kernel: 6.1.0-13-generic
server check-in: succeeded
patch state: ●  running kernel is NOT yet covered
patch version: 0
...

When live patching is safe

Safe use cases:

• A CVE patch for a specific function (e.g., a bounds check bug).
• A driver bug fix that affects a peripheral the host uses.
• A performance fix for a hot code path.

When live patching is NOT safe:

• ABI changes (struct field additions).
• Filesystem format changes (require unmount/remount or new filesystem).
• Hardware enablement (e.g., new CPU instructions).
• Anything that affects early-boot code paths (before ftrace is ready).

$ kpatch info kpatch-6.1.0-1.el9_1

patch name: kpatch-6.1.0-1.el9_1
kernel version: 6.1.0-1.el9
patch description: Livepatch for CVE-2025-XXXX
...

Operational policy

The production question is: when to live-patch and when to reboot?

1. Configure automatic live-patching for routine security patches. RHEL and Ubuntu ship with this enabled in the default subscription
2. Document the live-patch backlog in the runbook — what patches are pending reboot, what host they affect
3. Schedule periodic reboots for non-live-patchable updates and to clear the patch backlog
4. Test live-patching on a clone host before enabling in production; the patching daemon is itself a kernel module
5. Audit live-patch state quarterly. Use kpatch list or canonical-livepatch status for every host. Tainted flag K (live-patch applied) confirms the patch loaded

Knowledge check