--- title: Linux kernel Livepatching description: A high level introduction to Ubuntu Linux kernel livepatching and the processes around it. url: https://canonical.com/blog/linux-kernel-livepatching?format=md --- 1. [Blog](https://canonical.com/blog) 2. Article --- [Nikos Mavrogiannopoulos](https://canonical.com/blog/author/nmavrogiannopoulos "More about Nikos Mavrogiannopoulos") 9 July 2021 # Linux kernel Livepatching [kernel](https://canonical.com/blog/tag/kernel) [livepatch](https://canonical.com/blog/tag/livepatch) [Security](https://canonical.com/blog/tag/security) [Ubuntu Server](https://canonical.com/blog/tag/ubuntu-server) [Vulnerabilities](https://canonical.com/blog/tag/vulnerabilities) --- Share the article [Ubuntu Livepatch](https://ubuntu.com/security/livepatch) is the service and the software that enables organizations to quickly patch vulnerabilities on the Ubuntu Linux kernels. Livepatch provides uninterrupted service while reducing fire drills during high and critical severity kernel vulnerabilities. It is a complex technology and the details can be confusing, so in this post we provide a high level introduction to Ubuntu Linux kernel livepatching and the processes around it. ## Livepatch introduction When reviewing the major cybersecurity data breaches via web services (e.g., from the [2021 Verizon data breach investigations report](https://www.verizon.com/business/resources/reports/dbir/)), one cannot but notice that after credential based attacks, the exploitation of vulnerabilities is the major attack vector.  According to the same report, only a quarter of scanned organizations patch vulnerabilities in less than two months after being public, something that indicates that organizations are not generally proactive and consistent in vulnerability patching. And that’s not without a reason; addressing vulnerabilities through unplanned work is a challenge as it takes the organization’s focus away by creating unplanned maintenance windows where patches are being applied and systems are rebooted, while its customers or users face an unavailable service. At the same time, threats do not go away; critical and high severity vulnerabilities can appear at arbitrary times and potentially expose important data or services. Canonical’s vulnerability data show that 40% of high and critical severity vulnerabilities affect the Linux kernel, the highest of any other package. Addressing this vulnerability window quickly and smoothly for Ubuntu systems, is the goal of Ubuntu Livepatch. It eliminates the need for unplanned maintenance windows for critical and high severity kernel vulnerabilities, by patching the Linux kernel while the system runs. ## What happens when a kernel vulnerability is detected? In particular, when Canonical detects a high or critical vulnerability on the Linux kernel we will create a livepatch addressing the vulnerability. After the livepatch is made available, it is tested in Canonical’s internal server farm, and then promoted gradually to a series of testing tiers ensuring that any released livepatch has been tested sufficient time on live systems. Once the patch is released a [Livepatch Security Notice](https://ubuntu.com/security/notices) is issued and systems that enable the Ubuntu Livepatch client will receive the patch over an authenticated channel and apply it. ## How does kernel livepatching work? There are many types of vulnerabilities and many reasons behind them, such as a logic error or a missing check in a small piece of code, and others. On the high level the livepatch will provide new kernel code replacing the vulnerable one, and will update the rest of the kernel to use the new code. The diagram below shows how a kernel vulnerability is being patched using Ubuntu Livepatch. The simplistic description above shows the principle, but also hints on why some vulnerabilities that depend on very complex code interactions cannot be livepatched. When a kernel vulnerability cannot be livepatched, a [Livepatch Security Notice](https://ubuntu.com/security/notices) is issued that advises to apply any pending kernel updates and reboot. ## How can I access the Canonical Livepatch Livepatch is available through Ubuntu Pro to organizations and customers that take advantage of Ubuntu’s security features. Beyond that, as Ubuntu’s mission is to bring free software to the widest audience, developers and individuals can access Ubuntu Livepatch through a free subscription. The free subscription allows for up to 3 machines and up to 50 for Ubuntu community members.  [[Get Ubuntu Advantage](https://ubuntu.com/advantage#livepatch)] [[Get a Free subscription](https://ubuntu.com/advantage)] ## How to enable Ubuntu Livepatch Ubuntu Livepatch can be enabled in two steps; First obtain your subscription token via the [Ubuntu Advantage portal](https://ubuntu.com/advantage). The first step is necessary for both free subscription and Ubuntu Advantage users, but it is not necessary on Ubuntu Pro. Then you will need to enable it. The steps are: ``` $ sudo ua attach [TOKEN] $ sudo ua enable livepatch ``` ## Conclusions The Ubuntu Livepatch service reduces your unplanned work and allows you to schedule your maintenance windows. Take advantage of livepatching and provide uninterrupted service to your users by applying high and critical severity kernel updates without rebooting. [Get in touch](https://ubuntu.com/security/livepatch#get-in-touch) ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. By submitting this form, I confirm that I have read and agree to [Canonical's Privacy Policy](https://canonical.com/legal/dataprivacy). Sign up ## Share on --- ## Related posts [### Januscape vulnerability CVE-2026-53359 mitigations available](https://canonical.com/blog/januscape-linux-vulnerability-mitigations-available) Introduction A local privilege escalation (LPE) vulnerability affecting the Linux kernel was publicly disclosed on July 6, 2026. The vulnerability was assigned CVE ID... [seth-arnold](https://canonical.com/blog/author/seth-arnold) 11 July 2026 [### DirtyClone Linux kernel local privilege escalation vulnerability fixes available](https://canonical.com/blog/dirtyclone-linux-vulnerability-fixes-available) On June 25, 2026, JFrog published their research into CVE-2026-43503, referring to the vulnerability as DirtyClone. The vulnerability had previously been responsibly disclosed... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026 [### pedit COW kernel local privilege escalation vulnerability mitigations](https://canonical.com/blog/pedit-cow-linux-vulnerability-fixes-available) Mitigations are available for the Linux vulnerability with CVE ID CVE-2026-46331. The CVE ID was assigned on June 16 2026 and highlighted as a local privilege escalation (LPE)... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026 [### PinTheft Linux kernel vulnerability mitigation](https://canonical.com/blog/pintheft-linux-kernel-vulnerability-mitigation) A local privilege escalation (LPE) security vulnerability in the Linux kernel, codename “PinTheft,” was publicly disclosed on May 19, 2026. The vulnerability was fixed in the... [seth-arnold](https://canonical.com/blog/author/seth-arnold) 21 May 2026