{"id":986,"date":"2026-08-27T23:13:44","date_gmt":"2026-08-27T23:13:44","guid":{"rendered":"https:\/\/virtualserversvps.com\/blog\/?p=986"},"modified":"2026-09-06T22:07:39","modified_gmt":"2026-09-06T22:07:39","slug":"kernel-live-patching-vps-kpatch-setup","status":"publish","type":"post","link":"https:\/\/virtualserversvps.com\/blog\/kernel-live-patching-vps-kpatch-setup\/","title":{"rendered":"Keep Your VPS Kernel Secure Without Downtime: A Practical Guide to Kpatch Live Patching"},"content":{"rendered":"

Rebooting a production VPS<\/a> for every kernel security update is not sustainable. Each reboot drops connections, interrupts services, and risks data inconsistency. Kpatch is an open-source tool that patches a running kernel in memory, applying security fixes without a restart. Here is how to set it up, verify it works, and automate it on your VPS.<\/p>\n

What Kpatch Actually Does<\/h2>\n

Kpatch works at the function level. When a security vulnerability is patched upstream, the fix usually modifies one or two functions. Kpatch compiles a kernel module containing only the corrected versions of those functions. At load time, the kpatch core intercepts calls to the old functions using ftrace and redirects them to the new implementations. The kernel never stops running, and processes are unaware that the code underneath them changed.<\/p>\n

This approach has limits. Patches that modify data structures, change function signatures, or touch initialization code cannot be applied live. Kpatch handles the most common case \u2014 a logic bug or buffer overflow fixed by swapping in a corrected function body \u2014 and that covers roughly 70% of kernel CVEs.<\/p>\n

Checking Kernel Compatibility<\/h2>\n

First, confirm your kernel was built with live patching support. Most VPS images from Ubuntu 22.04, Debian 12, Rocky Linux 9, and Fedora 38 onward include it by default.<\/p>\n

# Quick check on any system\ngrep CONFIG_LIVEPATCH \/boot\/config-$(uname -r)\n\n# Expected output:\n# CONFIG_LIVEPATCH=y\n\n# If the config file is not in \/boot, try \/proc\ngrep CONFIG_LIVEPATCH \/proc\/config.gz 2>\/dev\/null || \\\n  zcat \/proc\/config.gz 2>\/dev\/null | grep CONFIG_LIVEPATCH<\/code><\/pre>\n
If live patching is not enabled, you need a kernel upgrade and a single reboot to get there. This is a one-time cost.<\/p>\n
Installing Kpatch on Ubuntu and Debian<\/h2>\n
sudo apt update\nsudo apt install kpatch kpatch-build -y\n\n# Verify the tools are installed\nkpatch --version\n\n# Check that the kpatch kernel module loaded\nlsmod | grep kpatch<\/code><\/pre>\n
On RHEL-based systems, install from EPEL:<\/p>\n
sudo dnf install epel-release -y\nsudo dnf install kpatch kpatch-dnf -y<\/code><\/pre>\n
Applying a Live Patch<\/h2>\n
Distribution repositories ship pre-built kpatch modules alongside kernel security updates. When you install a kernel update, the package manager also places a live patch module in \/usr\/lib\/kpatch\/<kernel-version>\/<\/code>. Loading it is a single command:<\/p>\n
# List available patches for your running kernel\nls \/usr\/lib\/kpatch\/$(uname -r)\/*.ko 2>\/dev\/null\n\n# Load a specific patch\nsudo kpatch load \/usr\/lib\/kpatch\/$(uname -r)\/CVE-2024-12345.ko\n\n# Verify the patch is active\nsudo kpatch list\n# Output: Loaded patch modules:\n# kpatch_CVE_2024_12345 [enabled]<\/code><\/pre>\n
Building a Custom Patch from Source<\/h2>\n
If your distribution does not ship a pre-built module for a specific CVE, you can build one yourself. This requires the kernel source or debug symbols for your exact kernel version.<\/p>\n
# Install build dependencies\nsudo apt install linux-headers-$(uname -r) build-essential elfutils libelf-dev -y\n\n# Create a patch file from the CVE fix\n# Example: simple fix for a kernel function\ncat > \/tmp\/cve-fix.patch << 'EOF'\ndiff --git a\/kernel\/example.c b\/kernel\/example.c\n--- a\/kernel\/example.c\n+++ b\/kernel\/example.c\n@@ -42,6 +42,8 @@\n int vulnerable_function(void *data) {\n+    if (!data)\n+        return -EINVAL;\n     return do_work(data);\n }\nEOF\n\n# Build the kpatch module\nsudo kpatch-build -t vmlinux \/tmp\/cve-fix.patch \\\n  --vmlinux \/usr\/lib\/debug\/boot\/vmlinux-$(uname -r)\n\n# The output is kpatch-cve-fix.ko in the current directory\nsudo kpatch load .\/kpatch-cve-fix.ko<\/code><\/pre>\n
Automating Patch Application with Systemd<\/h2>\n
The safest approach is to automatically apply any available live patches on boot and periodically check for new ones:<\/p>\n
#!\/bin\/bash\n# \/usr\/local\/sbin\/apply-kpatch.sh\n# Load all available kpatch modules for the running kernel\n\nPATCH_DIR=\"\/usr\/lib\/kpatch\/$(uname -r)\"\n\nif [ ! -d \"$PATCH_DIR\" ]; then\n    exit 0\nfi\n\nfor patch in \"$PATCH_DIR\"\/*.ko; do\n    [ -f \"$patch\" ] || continue\n    name=$(basename \"$patch\" .ko)\n    if ! kpatch list 2>\/dev\/null | grep -q \"$name\"; then\n        logger -t kpatch \"Loading patch: $name\"\n        kpatch load \"$patch\"\n    fi\ndone<\/code><\/pre>\n
# \/etc\/systemd\/system\/kpatch-apply.service\n[Unit]\nDescription=Apply kernel live patches\nAfter=network.target\n\n[Service]\nType=oneshot\nExecStart=\/usr\/local\/sbin\/apply-kpatch.sh\nRemainAfterExit=no\n\n# \/etc\/systemd\/system\/kpatch-apply.timer\n[Unit]\nDescription=Daily kernel live patch check\n\n[Timer]\nOnCalendar=daily\nOnBootSec=60\nPersistent=true\n\n[Install]\nWantedBy=timers.target<\/code><\/pre>\n
sudo chmod +x \/usr\/local\/sbin\/apply-kpatch.sh\nsudo systemctl daemon-reload\nsudo systemctl enable --now kpatch-apply.timer<\/code><\/pre>\n
Troubleshooting Common Issues<\/h2>\n