Kernel Live Patching (KLP) lets you apply security patches and critical bug fixes to a running Alibaba Cloud Linux kernel without rebooting. Servers stay available throughout the patching process — no business interruption, no task migration, no waiting for in-progress workloads to complete.
KLP is a temporary measure, not a replacement for regular kernel updates. It reduces unplanned reboots by addressing critical issues quickly, but a full kernel upgrade and reboot are still required for complete protection.
How KLP works
KLP comprises three components that work together to load and persist patches:
| Component | Description |
|---|---|
| Patch RPM package | An RPM package containing the kernel module (.ko file) and a patch description file. The kernel loads this module to apply fixes. |
| kpatch tool | A command-line tool for managing the kernel modules in each patch. |
| kpatch service | The systemd daemon for KLP. During system startup, this service loads kernel modules from patches to re-apply the fixes. |
Coverage and scope
KLP primarily addresses Critical and High-severity common vulnerabilities and exposures (CVEs) and critical bug fixes. It does not cover all high-severity issues. This feature is designed to reduce, but not eliminate, server reboots for patching.
Use KLP when a server cannot be rebooted immediately and requires urgent protection against a critical security vulnerability or bug.
Limitations
Supported kernel versions
KLP is available only on Alibaba Cloud Linux with the following minimum kernel versions:
| Alibaba Cloud Linux version | Minimum kernel version |
|---|---|
| Alibaba Cloud Linux 2.1903 | kernel-4.19.24-9.al7.x86_64 |
| Alibaba Cloud Linux 3.2104 | 5.10.23-4.al8.x86_64 |
| Alibaba Cloud Linux 4 | 6.6.88-4.2.alnx4.x86_64 |
Support period
Each Alibaba Cloud Linux kernel version receives one year of KLP support. After the support period ends, upgrade the kernel to the latest version to continue receiving live patches.
General-purpose use restriction
KLP is not a general-purpose kernel upgrade solution. Use it only to apply patches for high-severity security vulnerabilities or important bug fixes when a server cannot be rebooted immediately.
Tool incompatibility
Do not use SystemTap or kprobe to test or trace patched functions during or after applying a patch. Doing so will cause the patch to fail.
Next steps
To get, enable, or disable KLP, see Operations related to kernel hotfixes.