Kernel Live Patching: Mitigating CVEs With Zero Downtime
summary
Live patching applies function-level fixes without reboot by allocating new code, redirecting calls via ftrace trampolines, and switching tasks over only after per-task safety checks to avoid deadlocks; demo changes proc/cmdline and can be applied and unapplied live. Patch generation uses KLP build (merged in 7.0) which builds the kernel twice, diffs functions using control‑flow checksums, and produces a livepatch module. Operational costs grow fast (example claim: 119 patches for many releases), and rebooting eventually remains required.
AI-written summary · about
chapters (11)
- 0:00Linux kernel live patching intro
- 1:26Live patching mitigates CVEs
- 3:57Ftrace redirects kernel functions
- 6:29Live patching demo with kernel module
- 7:51Deadlocks in live patching
- 10:41KLP build tool evolution
- 13:07Live patch module maintenance
- 14:36Live patching as product
- 15:40Live patching limitations
- 16:46Live patching vs reboot
- 17:30Takeaways on live patching
related talks
41mKernel Live Patching at Scale
39mLet's meet the kernel livepatch feature
47mAdaptive Kernel Live Patching: An Open Collaborative Effort...
27mAdaptive Android Kernel Live Patching
41mLivepatch in Userspace Based on Uprobe
39mCloudLinux runtime kernel update for ARM growth difficulties
26mEngineering for the Long Haul: Operating Open Source at Scale
17mSustaining Yesterday’s Linux: Delivering Security for Today’s Workloads