{"id":986,"date":"2026-08-27T23:13:44","date_gmt":"2026-08-27T23:13:44","guid":{"rendered":"https:\/\/virtualserversvps.com\/blog\/?p=986"},"modified":"2026-10-15T22:02:47","modified_gmt":"2026-10-15T22:02:47","slug":"kernel-live-patching-vps-kpatch-setup","status":"publish","type":"post","link":"https:\/\/virtualserversvps.com\/blog\/kernel-live-patching-vps-kpatch-setup\/","title":{"rendered":"Kpatch Live Kernel Patching on a VPS: Limits, Verification, and Automation"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">A kernel security update normally means a reboot, and a reboot on a <a href=\"https:\/\/virtualserversvps.com\/\">VPS<\/a> means dropped connections, restarted services, and a window where nothing is serving traffic. Live patching removes that trade-off for the subset of CVEs that can be fixed by replacing a function body in memory. This article covers what Kpatch can and cannot patch, how to verify a live patch actually took effect, and how to automate the workflow so security updates land without a maintenance window. The same reasoning applies to fleet-wide security work such as <a href=\"https:\/\/virtualserversvps.com\/blog\/ssh-security-best-practices-vps-2\/\">SSH key rotation across a VPS fleet<\/a> \u2014 the value is in the routine, not the one-off.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How Live Patching Works Under the Hood<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Kpatch operates at function granularity. When a CVE is fixed upstream, the change usually touches one or two functions. Kpatch compiles a kernel module containing only the corrected versions, then uses <code>ftrace<\/code> to intercept calls to the original functions and redirect them to the new implementations. The kernel never stops; running processes never notice that the code beneath them changed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is powerful but bounded. Patches that modify data structures, change function signatures, or touch initialization code cannot be applied live. In practice, function-body fixes cover roughly 70% of kernel CVEs \u2014 a large majority, but <em>not all<\/em>. You still eventually need a real reboot for the remainder, so live patching is a delay mechanism, not an alternative to rebooting forever.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Confirming Your Kernel Supports It<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before installing anything, check whether the running kernel was built with live patching support and whether the required tracepoints are compiled in:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>uname -r\ngrep CONFIG_LIVEPATCH \/boot\/config-$(uname -r)\nmount | grep tracefs\nls \/sys\/kernel\/livepatch 2>\/dev\/null<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>CONFIG_LIVEPATCH=y<\/code> is required. A missing <code>\/sys\/kernel\/livepatch<\/code> directory usually means the module is not loaded yet rather than unsupported \u2014 load it and re-check.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Installing Kpatch on Ubuntu and RHEL-family Hosts<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">On RHEL, Rocky, and AlmaLinux the tooling ships in the base repositories and integrates with the package manager:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo dnf install kpatch kpatch-dnf -y\nsudo kpatch list<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">On Ubuntu and Debian the ecosystem differs \u2014 Canonical publishes livepatch through the <code>ubuntu-advantage<\/code> (formerly <code>canonical-livepatch<\/code>) service rather than as freely distributed kpatch modules. The command surface is the same idea:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo snap install canonical-livepatch\nsudo canonical-livepatch enable &lt;token&gt;\nsudo canonical-livepatch status --verbose<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Do not assume kpatch is available for every kernel release on a given distribution. Live patches are built against specific kernel versions; if your VPS provider pins a custom kernel, patches may lag or be unavailable. Check before committing to the workflow.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Verifying a Patch Actually Applied<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Installing the module and having it actually patch the running kernel are two different things. The authoritative check reads the livepatch sysfs state, where each patch reports <code>enabled<\/code> or <code>transition<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo kpatch list\ncat \/sys\/kernel\/livepatch\/*\/enabled\ndmesg | grep -i kpatch<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>enabled = 1<\/code> means the patch is active for new calls. A value stuck at <code>0<\/code> with a <code>transition<\/code> message means the kernel is waiting for in-flight executions of the old function to drain before switching \u2014 this is normal and usually clears within seconds.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Automating the Workflow<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The point of live patching is to make kernel security updates routine. Wire it into the update path so patches apply on a schedule without interaction. For RHEL-family hosts:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl enable --now kpatch.service\ndnf install kpatch-dnf\nkpatch-dnf enable<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>kpatch-dnf enable<\/code> hooks the patch modules into normal package upgrades, so a <code>dnf update<\/code> applies live patches as they ship. For periodic unattended updates, a systemd timer or cron job running <code>dnf -y update<\/code> on a maintenance schedule completes the loop. This is the same class of automation as <a href=\"https:\/\/virtualserversvps.com\/blog\/unattended-upgrades-failure-modes-vps-deferred-reboots\/\">unattended-upgrades failure modes<\/a> on Debian\/Ubuntu, where deferred reboots silently accumulate \u2014 the failure mode to watch for here is live patches that stack up while the underlying reboot debt grows.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The Reboot Debt Problem<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Live patching can lull you into never rebooting. That is a trap. Patches that cannot be applied live still accumulate, and a kernel that has run for 300 days with dozens of un-appliable patches pending is fragile. Track reboot debt explicitly:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/var\/run\/reboot-required 2>\/dev\/null\nsudo kpatch list | grep -c '\\[enabled\\]'\nuname -r && rpm -q kernel | tail -1<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">When the installed kernel package version exceeds the running <code>uname -r<\/code>, a reboot is pending. Schedule it deliberately during a low-traffic window instead of discovering it mid-incident.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Rollback When a Patch Misbehaves<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Live patches occasionally cause regressions \u2014 a rare race, a wrong fix, an interaction with another module. Because the patch is a loadable module, you can disable it without rebooting, which is the whole point:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>echo 0 | sudo tee \/sys\/kernel\/livepatch\/&lt;patch&gt;\/enabled\nsudo kpatch unload &lt;patch&gt;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Writing <code>0<\/code> to the <code>enabled<\/code> file starts a reverse transition: new calls go to the original function while in-flight ones drain, then the patch unloads cleanly. This is dramatically faster and less disruptive than rebooting into the previous kernel, but it also means a broken live patch can be backed out in seconds \u2014 a safety net you do not get with a conventional kernel upgrade.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Monitoring Live Patch State Over Time<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Live patches are invisible in normal monitoring until something depends on them. Add a lightweight check to your existing exporter or a cron probe so you catch a patch that failed to apply or silently unloaded:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#!\/bin\/sh\n# \/usr\/local\/bin\/kpatch-check.sh \u2014 alert if any patch is not enabled for &lt;patch&gt; in $(ls \/sys\/kernel\/livepatch); do\n  [ \"$(cat \/sys\/kernel\/livepatch\/$patch\/enabled)\" = \"1\" ] || echo \"$patch not enabled\"\ndone<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Feed that script&#8217;s output into your alerting; a patch reporting <code>transition<\/code> indefinitely, or disappearing from sysfs after a kernel upgrade, is exactly the silent failure that leaves a host believing it is patched when it is not.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">When Live Patching Is the Wrong Choice<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Live patching is not universal. On kernels the vendor does not build patches for, on hosts where the affected subsystem is a data-structure change, or on machines that can tolerate a two-second reboot anyway, the effort may exceed the benefit. A stateless worker behind a load balancer that drains and restarts cleanly in seconds \u2014 the pattern covered in <a href=\"https:\/\/virtualserversvps.com\/blog\/zero-downtime-service-reloads-connection-draining-vps\/\">zero-downtime service reloads with connection draining<\/a> \u2014 gains little from live patching, because it already has no meaningful downtime. Reserve the mechanism for stateful, single-instance, or high-availability-sensitive hosts where a reboot genuinely costs money.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The Takeaway<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Live patching is a legitimate, well-documented mechanism for applying about 70% of kernel security fixes without downtime \u2014 provided you verify patches actually reach <code>enabled<\/code> state, check whether your specific kernel build is even supported, and treat reboots as deferred rather than eliminated. Automate the patch path, monitor reboot debt, and schedule the inevitable real reboots on your terms. Used that way, Kpatch meaningfully shortens a VPS&#8217;s exposure to known kernel CVEs.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A kernel security update normally means a reboot, and a reboot on a VPS means dropped connections, restarted services, and a window where nothing is serving traffic. Live patching removes&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":14,"footnotes":""},"categories":[4],"tags":[],"class_list":["post-986","post","type-post","status-publish","format-standard","hentry","category-security-compliance"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.1 (Yoast SEO v26.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Kpatch Live Kernel Patching on a VPS: Limits, Verification, and Automation - Virtual Servers VPS Blog<\/title>\n<meta name=\"description\" content=\"A kernel security update normally means a reboot, and a reboot on a VPS means dropped connections, restarted services, and a window where nothing is\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/virtualserversvps.com\/blog\/kernel-live-patching-vps-kpatch-setup\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Kpatch Live Kernel Patching on a VPS: Limits, Verification, and Automation\" \/>\n<meta property=\"og:description\" content=\"Kpatch Live Kernel Patching on a VPS: Limits, Verification, and Automation\" \/>\n<meta property=\"og:url\" content=\"https:\/\/virtualserversvps.com\/blog\/kernel-live-patching-vps-kpatch-setup\/\" \/>\n<meta property=\"og:site_name\" content=\"Virtual Servers VPS Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-27T23:13:44+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-15T22:02:47+00:00\" \/>\n<meta name=\"author\" content=\"Virtual-Servers-Vps-Editor\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Virtual-Servers-Vps-Editor\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/kernel-live-patching-vps-kpatch-setup\/\",\"url\":\"https:\/\/virtualserversvps.com\/blog\/kernel-live-patching-vps-kpatch-setup\/\",\"name\":\"Kpatch Live Kernel Patching on a VPS: Limits, Verification, and Automation - Virtual Servers VPS Blog\",\"isPartOf\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#website\"},\"datePublished\":\"2026-08-27T23:13:44+00:00\",\"dateModified\":\"2026-10-15T22:02:47+00:00\",\"author\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0\"},\"description\":\"A kernel security update normally means a reboot, and a reboot on a VPS means dropped connections, restarted services, and a window where nothing is\",\"breadcrumb\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/kernel-live-patching-vps-kpatch-setup\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/virtualserversvps.com\/blog\/kernel-live-patching-vps-kpatch-setup\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/kernel-live-patching-vps-kpatch-setup\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/virtualserversvps.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Kpatch Live Kernel Patching on a VPS: Limits, Verification, and Automation\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#website\",\"url\":\"https:\/\/virtualserversvps.com\/blog\/\",\"name\":\"Virtual Servers VPS Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/virtualserversvps.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0\",\"name\":\"Virtual-Servers-Vps-Editor\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g\",\"caption\":\"Virtual-Servers-Vps-Editor\"},\"sameAs\":[\"https:\/\/virtualserversvps.com\/blog\"],\"url\":\"https:\/\/virtualserversvps.com\/blog\/author\/virtualserversvps\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Kpatch Live Kernel Patching on a VPS: Limits, Verification, and Automation - Virtual Servers VPS Blog","description":"A kernel security update normally means a reboot, and a reboot on a VPS means dropped connections, restarted services, and a window where nothing is","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/virtualserversvps.com\/blog\/kernel-live-patching-vps-kpatch-setup\/","og_locale":"en_US","og_type":"article","og_title":"Kpatch Live Kernel Patching on a VPS: Limits, Verification, and Automation","og_description":"Kpatch Live Kernel Patching on a VPS: Limits, Verification, and Automation","og_url":"https:\/\/virtualserversvps.com\/blog\/kernel-live-patching-vps-kpatch-setup\/","og_site_name":"Virtual Servers VPS Blog","article_published_time":"2026-08-27T23:13:44+00:00","article_modified_time":"2026-10-15T22:02:47+00:00","author":"Virtual-Servers-Vps-Editor","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Virtual-Servers-Vps-Editor","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/virtualserversvps.com\/blog\/kernel-live-patching-vps-kpatch-setup\/","url":"https:\/\/virtualserversvps.com\/blog\/kernel-live-patching-vps-kpatch-setup\/","name":"Kpatch Live Kernel Patching on a VPS: Limits, Verification, and Automation - Virtual Servers VPS Blog","isPartOf":{"@id":"https:\/\/virtualserversvps.com\/blog\/#website"},"datePublished":"2026-08-27T23:13:44+00:00","dateModified":"2026-10-15T22:02:47+00:00","author":{"@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0"},"description":"A kernel security update normally means a reboot, and a reboot on a VPS means dropped connections, restarted services, and a window where nothing is","breadcrumb":{"@id":"https:\/\/virtualserversvps.com\/blog\/kernel-live-patching-vps-kpatch-setup\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/virtualserversvps.com\/blog\/kernel-live-patching-vps-kpatch-setup\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/virtualserversvps.com\/blog\/kernel-live-patching-vps-kpatch-setup\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/virtualserversvps.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Kpatch Live Kernel Patching on a VPS: Limits, Verification, and Automation"}]},{"@type":"WebSite","@id":"https:\/\/virtualserversvps.com\/blog\/#website","url":"https:\/\/virtualserversvps.com\/blog\/","name":"Virtual Servers VPS Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/virtualserversvps.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0","name":"Virtual-Servers-Vps-Editor","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g","caption":"Virtual-Servers-Vps-Editor"},"sameAs":["https:\/\/virtualserversvps.com\/blog"],"url":"https:\/\/virtualserversvps.com\/blog\/author\/virtualserversvps\/"}]}},"_links":{"self":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/986","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/comments?post=986"}],"version-history":[{"count":4,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/986\/revisions"}],"predecessor-version":[{"id":1411,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/986\/revisions\/1411"}],"wp:attachment":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/media?parent=986"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/categories?post=986"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/tags?post=986"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}