CME-1102

Live Kernel Patching (kpatch/livepatch)

Evict OS/Kernel Unquantified evidence Corrective

Description

Applies critical kernel security fixes without system reboot, eliminating the patch-reboot delay that leaves systems vulnerable. Patches are applied to the running kernel in memory.

CVSS Vector Impacts

Metric	Transition	Rationale
Attack Complexity (AC)	L → H	Temporal: kernel vulnerability patched immediately without reboot window

CWE Relationships

CWE-119

Verification

Check for active kernel live patches

$ kpatch list
# Expected: installed

Platform: rhel

$ canonical-livepatch status
# Expected: running

Platform: debian

Remediation

rhel RHEL kpatch live kernel patching


dnf install -y kpatch kpatch-dnf
dnf install -y kpatch-patch-$(uname -r | sed 's/\.[^.]*$//')
systemctl enable kpatch