Zero‑Downtime Kernel Updates on RHEL with Live Patching (kpatch)

Why Live Patching Matters on RHEL

In a production environment, a kernel reboot can mean lost service, missed SLA windows, or manual intervention. Red Enterprise Linux’s kpatch feature lets you apply critical security fixes directly in memory, keeping the system running while the kernel code is updated. The key takeaway: if you need to stay online, kpatch is the supported path for RHEL 7.6+ and RHEL 8.x.

What kpatch Can and Cannot Do

• Can patch existing code paths in the running kernel.
• Cannot change kernel configuration options or load new modules.
• Requires a signed ELF patch object from Red Hat’s Live Patching repository.
• Works only on supported kernel versions; attempting to patch an unsupported kernel will fail with a clear error.

Prerequisites Checklist

1. RHEL 7.6+ or RHEL 8.x with a valid subscription that includes the Live Patching add‑on.
2. Access to the subscription-manager tool (root or sudo).
3. Network connectivity to Red Hat’s Live Patching repositories.

Enable the Live Patching Repository

On RHEL 7:

# subscription-manager repos --enable rhel-7-server-kernel-ml-rpms

On RHEL 8:

# subscription-manager repos --enable rhel-8-for-x86_64-baseos-rpms
# subscription-manager repos --enable rhel-8-for-x86_64-appstream-rpms

After enabling, verify with:

# subscription-manager repos --list-enabled | grep -i live

Install the kpatch Utility

# dnf install kpatch   # RHEL 8
# yum install kpatch   # RHEL 7

Applying a Patch – A Concrete Example

Suppose Red Hat releases a patch named kpatch-5.10.0-1050.6.1.el8.x86_64 to fix a CVE. The patch is delivered as a signed ELF file. Here’s how to apply it:

1. Download the patch: The kpatch tool can fetch it automatically, but you can also download it manually from the repository.

   # dnf download kpatch-5.10.0-1050.6.1.el8.x86_64
   

2. Apply the patch:

   # kpatch apply kpatch-5.10.0-1050.6.1.el8.x86_64
   

   • Requires root privileges.
   • The command returns Applied patch if successful, otherwise an error message.
3. Verify the patch state:

   # kpatch status
   

   The output shows the patch name and a stable status if it has passed the in‑memory verification.

4. Check the log for details:

   # cat /var/log/kpatch/kpatch.log | tail -n 20
   

   Look for entries like Patch applied successfully or any warnings.

Monitoring and Validation After Patching

Applying a patch is only part of the process. You need to confirm that the system behaves normally and that the new code path is exercised.

• Check kpatch status regularly: kpatch status will list all applied patches and their stability state.
• Review kernel logs: journalctl -k | grep -i kpatch can surface any runtime issues.
• Run uname -r to confirm the kernel version matches the patched release.
• Use automated tests or monitoring tools that exercise the affected functionality to ensure the patch is effective.

Trade‑offs and Limitations

• Subscription cost: The Live Patching add‑on is an extra subscription item; evaluate ROI versus reboot windows.
• Kernel version support: kpatch only works on certain kernel releases. If you run a custom or older kernel, you cannot use it.
• Patch scope: kpatch cannot add new modules or change kernel configuration. For those changes, a reboot is still required.
• Stability risk: While kpatch verifies patches before application, there is still a small risk of instability. Test patches in a staging environment first.

Actionable Checklist for Production Adoption

1. Confirm you have a Live Patching subscription and the repository is enabled.
2. Install the kpatch utility and test applying a known patch in a non‑production VM.
3. Set up a monitoring rule that triggers on kpatch status showing any unstable patches.
4. Document the patching process, including the exact commands and expected log entries.
5. Plan for fallback: if a patch causes issues, you can revert it with kpatch remove <patch> (available in newer kpatch releases).

By following these steps, you can confidently apply kernel security fixes on RHEL without taking your services offline, while maintaining visibility into the patch state and system health.