Live patching or hotpatching is about applying a kernel bug or security fix to a running kernel without rebooting the machine. It is commonly used for critical and high-priority fixes without downtime. Multiple vendors provide supported services like Canonical Livepatch and Red Hat kpatch. This step-by-step guide will cover a zero-downtime hotpatching Linux kernel.
This guide is provided by PerLod Hosting, which provides reliable Linux hosting and server solutions for businesses of all sizes.
Live patch or hotpatch means a system loads a special kernel module called a patch module, which replaces certain kernel functions with fixed versions. The system will redirect function calls to the new code instead of directly changing the code. This means hotpatching can fix security issues while the system is running without needing a reboot.
It only works for small and functional-level fixes. For big changes, you will still need a full reboot. Vendors will let you know when a reboot is required.
Tools or vendor options for live patching include:
You need to choose the tool supported by your distribution.
Before you start, you must back up sensitive data and have a rollback plan. Livepatching reduces reboot frequency but does not replace the normal patch lifecycle.
You need to verify your Linux kernel version and distro compatibility. Also, you must have root privileges for live patching.
Note: Some fixes cannot be applied by livepatch, and you will need a reboot. The live patching tools will report this. It is also recommended to test live patching in a non-production server first.
Now let's dive into live patching kernels on Linux distros.
Using Canonical Livepatch is the easiest supported option for Ubuntu LTS systems. First, run the system update and install the snapd package with the following commands:
Then, install the canonical-livepatch package by using snap:
Then, you must visit Ubuntu Livepatch, sign in to your Ubuntu account, and get a free personal-use token or an Ubuntu Pro token.
Then, enable the service with the token:
This command registers the host to Canonical’s livepatch service.
Next, you can check the status and applied patches by using the following command:
Or, you can use:
All applicable livepatch modules will be inserted. If a patch cannot be applied, the status will show that a kernel upgrade is required.
You can also use the following command to ask the client to recheck the server and get the latest patches:
Note: Keep in mind that Livepatch will not cover all kernel fixes; you must keep regular upgrades.
If you plan to disable and remove Canonical Livepatch, you can run the following commands:
The kpatch tool is the kernel live patching utility supported by Red Hat with RPM modules provided by Red Hat repositories. It is supported on RHEL, CentOS, Fedora, and dnf-based distros.
With kpatch, you can subscribe the currently installed kernel to the live patching stream or automatically subscribe any future kernel to the live patching stream.
To use auto patches, you need to install kpatch with the command below:
The kpatch-dnf package is the plugin to auto-install kpatch patches from vendor repositories.
Then, you can enable automatic subscription with the following command:
It installs available kpatch-patch packages for the running kernel and keeps future kernels subscribed.
Verify that installed kernels are patched with the command below:
If you prefer manual patching, proceed with these steps.
Check current kernel version:
Then, search for a live patching package that matches the kernel version:
Next, install the live patching package with the following command:
This command installs and applies the latest live patches for the current kernel only.
Verify that installed kernels are patched with the command below:
To unload and remove a patch, you can run the following commands:
If you want to stop auto-loading of patches at boot, run:
Ksplice (Uptrack) is a tool provided by Oracle that lets you apply security patches to the Linux kernel without rebooting. It usually needs an Oracle support subscription unless you are running certain free versions of Oracle Linux.
Download the installer script and configure it with the following commands:
Then, list which patches are applied or available with the command below:
Finally, apply updates with the command below:
This command installs the latest live patches immediately, without rebooting.
Here are the best practices you should consider for zero-downtime hotpatching Linux kernel:
1. Use vendor-supported livepatch tools: Each Linux system has its own live patching system. Use the tool officially supported by your distribution.
2. Keep backups and plan for restarts: Always keep tested backups so you can roll back if something goes wrong. And schedule a maintenance window for eventual reboots, so users are not surprised when downtime is needed.
3. Monitor system health after patching: After applying the live patch, check kernel logs for errors and warnings using journalctl -k and dmesg. Always check app performance and availability.
4. Use a test environment first: Apply new live patches on test servers before production. This helps confirm stability with your applications before rolling out to critical systems.
5. Track kernel and livepatch versions: It’s important to audit what patches are currently applied in your Linux system. Keep a record of this information for compliance, audits, or troubleshooting.
With zero-downtime hotpatching Linux kernel using supported tools like Canonical Livepatch, kpatch, and Ksplice, administrators can apply kernel fixes seamlessly, reduce downtime, and improve security posture. However, hotpatching is not a complete replacement for traditional patching; some updates still require planned reboots.
We hope this guide is useful for you. Subscribe to us on Facebook and X to get the latest updates and articles.
For further reading:
Explore Horizontal vs Vertical Scaling in Dedicated Servers
Hotpatching or Live patching means applying security or bug fixes to the running Linux kernel without rebooting the system.
Yes, if you use vendor-supported tools like Canonical livepatch and RKEL kpatch, it is safe.
In RHEL, use: rpm -qa | grep kpatch. For Ubuntu, use: apt list --installed | grep livepatch. And for Oracle Linux, run: uptrack-show.