Kernel updates without a reboot (livepatch)

In short: With livepatch, security vulnerabilities in the running kernel can be closed without rebooting the machine. That matters for servers that must not go down.

In more detail: The kernel receives small fixes to individual functions at run time.

In detail

• Kernel mechanism: kpatch (Red Hat), livepatch (SUSE, Canonical).
• Offers: Canonical Livepatch (for Ubuntu, free for up to five machines), Red Hat kpatch, KernelCare (third party), SUSE Live Patching.
• Limits: only for security-critical errors, not all changes. Now and then a normal reboot is needed.
• Alternatives: clusters with step-by-step restart (rolling restart).
• Kernel versions: check the running one with uname -r, the installed ones with the package manager.

See also: Kernel versions and release cycle, Package management on Linux at a glance