Zero-downtime kernel patching with Ksplice

Kernel security patches have traditionally come with an unavoidable cost: you apply the update, then you reboot, then you hope nothing on the way back up goes wrong. Oracle’s Ksplice technology removes the reboot from that equation for most kernel patches. Here’s how it actually works, and where its limits are.

What Ksplice does

Ksplice applies patches directly to the running Linux kernel in memory, without requiring a reboot to take effect. It works by taking the source-level patch for a kernel fix, compiling it, and inserting the compiled code into the running kernel while it’s still executing – redirecting the relevant functions to the patched versions on the fly. The system keeps running, active connections stay up, and the fix is live within seconds.

This matters most for security patches. A significant proportion of kernel CVEs over the years have been patchable via Ksplice, meaning a server can stay current on kernel security fixes without ever needing a maintenance window for a reboot.

How it’s used on Oracle Linux

Oracle Linux ships with the ability to use Ksplice via a client. Historically this was the “Uptrack” client, managed with the uptrack-upgrade command; Oracle now recommends the newer Ksplice Enhanced Client, managed via the ksplice command, which is a superset of the older client’s functionality. The Uptrack client and uptrack-upgrade command still work on Oracle Linux 8 and 9, but on Oracle Linux 10 the uptrack/uptrack-offline packages aren’t available at all – only the Ksplice Enhanced Client is supported there.

To check for and apply available kernel patches with the traditional client:

uptrack-upgrade -y

This lists any outstanding Ksplice updates for the currently running kernel and applies them without a reboot. For the newer Enhanced Client, Oracle’s documentation covers the equivalent ksplice subcommands – the concept is the same, just under a more actively maintained client. Either way, check Oracle’s current Ksplice documentation for your specific Oracle Linux version before relying on either client long-term, since the tooling has been in transition.

Who actually gets it for free

This is the part worth being upfront about. Ksplice is free to use if you have an Oracle Linux Premier Support subscription, or if you’re running Oracle Linux on Oracle Cloud Infrastructure (or on Azure, for Oracle Linux images there). Basic Support, Basic Limited, and Network Support subscribers don’t get it included, and neither does a plain self-managed install with no Oracle support contract – you can try it for a 30-day trial period, but ongoing use requires Premier Support.

In practice, that means most people running an unmanaged Oracle Linux VPS without a Premier Support contract will patch their kernel the conventional way – dnf update followed by a reboot – the same as they would on AlmaLinux or Rocky Linux. Ksplice is a real feature, but it’s a paid-support feature, not something baked into every Oracle Linux install by default.

What Ksplice can’t do

Ksplice is not a replacement for planned maintenance altogether. It can’t help with:

• Major kernel version upgrades – moving between substantially different kernel versions (as opposed to patching the running one) still needs a full reboot.
• Userspace and application updates – Ksplice’s kernel patching is separate from ordinary package updates for things like your web server, database or PHP runtime, which are applied and restarted the normal way.
• Changes requiring a different running kernel – some structural kernel changes are too invasive to hot-patch and still require a reboot regardless of Ksplice.

Why it matters for a production VPS

Reboots on a production server are never free, even when they’re quick. There’s the downtime window itself, the risk that a service doesn’t come back cleanly, and the coordination overhead of scheduling it around your traffic patterns. For workloads where availability really matters – and where you do have Premier Support or an OCI-hosted Oracle Linux instance – Ksplice removes a meaningful chunk of that operational friction for kernel security patching specifically. It’s a genuine differentiator for Oracle Linux, just one that’s gated behind a support subscription rather than available to everyone by default.

For more on what else is (and isn’t) genuinely different about Oracle Linux, see our post on what Oracle Linux is, and whether the “Unbreakable” branding is just marketing.