Keep Ubuntu Live and Secure: Using Livepatch to Patch the Kernel Without Reboot

Why Kernel Patching Without Reboot Matters

When a critical CVE lands in the kernel, the usual response is to install the update and reboot the host. For production servers, that downtime can be costly. Ubuntu Livepatch turns the kernel into a living document: it applies security patches in‑memory while the machine keeps running. This is a game‑changer for high‑availability workloads where even a few minutes of downtime can trigger SLA penalties.

What Livepatch Is and How It Works

Livepatch is an Ubuntu Pro feature that ships a snap package called ubuntu-livepatch. The snap installs a kernel module (livepatch.ko) and a user‑space daemon. When a new kernel patch is released, the daemon downloads the corresponding module, loads it into the running kernel, and applies the changes without touching the disk or restarting processes.

Key assumptions:

• The host runs a supported Canonical or Ubuntu kernel (e.g., 5.15.0‑60‑generic on 22.04 LTS).
• An active Ubuntu Pro subscription is attached to the machine.
• The snap is installed and the Livepatch service is enabled.

Step‑by‑Step Setup

1. Install the snap (requires sudo):

   sudo snap install ubuntu-livepatch
   

2. Register the machine with a token from the Ubuntu Pro portal. Replace <TOKEN> with your actual token:

   sudo ubuntu-livepatch register <TOKEN>
   

3. Verify that the service is active:

   ubuntu-livepatch status
   

   You should see a line like livepatch enabled: yes and a list of applied patches.
4. Test a patch cycle by forcing an update. For example, if a new CVE‑2026‑1234 patch is released, the daemon will fetch it automatically within minutes. You can confirm the patch by checking the log:

   cat /var/log/livepatch/livepatch.log | grep CVE-2026-1234
   

After a reboot, the snap will automatically re‑apply any pending patches, ensuring continuity across reboots.

Concrete Example: Patching CVE‑2026‑1234 on Ubuntu 22.04 LTS

Assume the following environment:

• Ubuntu 22.04 LTS, kernel 5.15.0‑60‑generic
• Ubuntu Pro subscription attached to the instance
• Livepatch snap already installed and registered

When the security team publishes the CVE‑2026‑1234 patch, the Livepatch daemon will:

1. Download the livepatch.ko module for this kernel version.
2. Load the module with modprobe.
3. Apply the in‑memory patch, replacing the vulnerable code paths.
4. Log the action to /var/log/livepatch/livepatch.log.

You can confirm the patch without rebooting by running:

ubuntu-livepatch status

Look for applied: CVE-2026-1234 in the output. The system remains online, and no services are interrupted.

Trade‑Offs and Limitations

• Scope: Livepatch only covers the kernel. User‑space packages still need apt update && apt upgrade for full system security.
• Kernel support: Custom kernels or non‑Canonical kernels cannot use Livepatch. If you compile your own kernel, you’ll lose this feature.
• Patch coverage: Not every kernel change can be applied live. Some patches require a full reboot to be fully effective.
• Subscription limits: Free tiers may restrict the number of patches per day or the kernel versions you can patch. Verify your subscription level in the Ubuntu Pro portal.
• Reboot behavior: The Livepatch module is loaded at boot, but if you manually reboot the system, the state of applied patches is lost until the next update cycle. This means a reboot will still be required to apply any patches that were pending at the time of reboot.

Actionable Checklist for Production Deployments

1. Confirm the host runs a supported Ubuntu kernel.
2. Attach an Ubuntu Pro subscription and note the token.
3. Install and register ubuntu-livepatch.
4. Verify status and monitor /var/log/livepatch for applied patches.
5. Document the Livepatch policy: which CVEs are covered, how often to check status, and the process for handling patches that require a reboot.
6. Set up alerts (e.g., via livepatchd or a custom script) to notify when a new patch is applied.

By following these steps, you can reduce kernel‑update downtime from hours to minutes, keeping critical services online while staying compliant with security requirements.

Conclusion

Ubuntu Livepatch turns the kernel from a static artifact into a dynamic, patchable resource. For teams that cannot afford downtime, it offers a practical solution to keep systems secure without the operational overhead of frequent reboots. However, it is not a silver bullet: you still need to manage user‑space updates, custom kernels, and subscription limits. Use Livepatch as part of a layered security strategy, and always validate that the patches you need are indeed applied in‑memory.