Elastic Compute Service
Elastic Compute Service
Elastic Compute Service
Document
Elastic Compute Service
What's New
Announcement
OpenAPI related
Pricing and quotas are related
About products and plugins
Feature discontinuation
Overview
Billing
Billable items
Billing methods
Billing methods change
Getting Started
User Guide
Instances
Instance types
X86 Computing
Elastic Bare Metal Server
Heterogeneous Computing
Select instance billing method
Spot instance
Elastic Scheduled Instance
Offsetting Resources
Reserved Instances
Buying ECS instances
Logging in to an instance
Logging in to a Linux instance
Managing instance status
Modifying instance types
Using instance user data and metadata
Instance metadata
Images
Public images
veLinux images
Custom images
Importing custom images
Creating custom images
Image detection
End of life (EOL) of image
Elastic Block Storage
Basic volume operations
Partitioning and formatting a volume
Extending a volume
EBS Agent
Snapshots
Basic snapshot operations
Auto snapshot policies
DataInsights
Network
Network interface and IP address
IP Address
IPv4 address
Security group
Security
Passwords and key pairs
Deployment and scaling
Monitoring
Monitoring metrics
Event monitoring
Local volume event O&M
Method 1: Solve the local volume failure by replacing the faulty volume
O&M
Cloud assistant
Managing agents
Process choreography
Common operation and maintenance tasks
Batch operations on instances
Batch operations on EBS Volumes
Batch operations on images
Temporary upgrade of bandwidth
Managing application updates
orchestration plan
Patch management
Managing patch plans
Managing patch baselines
IAM
Tags and projects
Best Practices
AI applications
OpenClaw (formerly Moltbot)
Quickly deploying OpenClaw via application templates
Quickly deploying OpenClaw via marketplace images
Manually deploying OpenClaw
Self-service website creation
Building environments
Building a Web environment (Windows)
Building applications
Building FTP site
Deploying databases
Building game servers
Building websites
Building a WordPress blog
Building multiple websites
Manage software sources for Linux instances
AIGC practices
Performance test
Network performance test
Instance configuration
Setting up AD Domain Services on Windows OS
Windows Multi - User Login
Changing screen resolution
Instance data
Uploading or downloading files
Data restoration
ECS instance local time synchronization
Volume
Monitoring
Security
Images
Kernel fine-tuning
O&M
Troubleshooting
Remote log in issue
Linux operating system issue
Windows operating system issue
SSH log in issue
Operating system issue
veLinux operating system issue
Linux operating system issue
Windows operating system issue
Instance status issue
Instance unable to start issue
High instance load issue
GPU instances issue
Network connection issue
Network configuration issue
Storage classes issue
EBS Volume issue
Local Disk issue
Logs and monitoring issue
Third - party software issue
API Reference
Regions and availability zones
Instances
Images
HPC clusters
Key pairs
Tags
Volumes
Reserved storage capacity
Snapshot
Auto snapshot policy
Monitoring
Deployment sets
Launch templates
Cloud assistant
Patch management
SDK reference
CLI Reference
FAQ
Dedicated Host DDH
What's New
Billing
User Guide
Manage Dedicated Host
Manage Dedicated Host Cluster
Manage ECS instances
Monitoring and O&M
API reference
proprietary host
- Documentation
Elastic Compute ServiceElastic Compute ServiceUser GuideImagesveLinux imagesKernel live patchingKernel live patching overview
Copy page
Download PDFKernel live patching
Kernel live patching overview
Copy pageDownload PDFKernel live patching overview
Volcano Engine provides live patching capabilities to fix high-severity Common Vulnerabilities and Exposures (CVEs) and important bugs in the veLinux image kernel. With these capabilities, you can quickly and seamlessly apply patches to the kernel without restarting the instance or the applications running on it, waiting for long-running tasks to complete, asking users to log out and log back in, or migrating applications. This improves the stability and security of the kernel.
Usage notes
The kernel live patching capabilities mainly apply to CVEs of Critical or higher severity and critical bugs. Each patch consists of the following components:
- DEB/RPM package: Contains kernel modules (ko files) and the patch description file. The kernel fixes issues by loading the kernel modules included in the patch.
- Livepatch system service: A system daemon (systemd) for kernel live patching. This service loads kernel modules for each patch during the operating system initialization phase to fix kernel issues.
Precautions
- Supported operating systems
- Operating systemOperating system versionKernel versionOperating systemOperating system versionKernel versionveLinuxveLinux 2.0
- All kernel versions support live patching.
- No special configurations are required.
veLinux 1.0- Kernel version ＜ 5.4.250-1-velinux
- Kernel version ＞ 5.4.250-5-velinux1u1
tipIf the kernel version of your operating system falls within the range of 5.4.250-1-velinux to 5.4.250-5-velinux1u1 (including 5.4.250-1-velinux and 5.4.250-5-velinux1u1), the kernel live patching feature is not supported. In this case, we recommend that you upgrade the kernel version.
- For each kernel version of the veLinux operating system, veLinux provides kernel live patching capabilities within a validity period of one year. After the validity period ends, you need to upgrade the kernel version of the operating system to the latest version.
- You can use the kernel live patching capabilities to fix only specific CVEs of the High severity and specific important bugs. The kernel live patching capabilities aim to reduce instance restarts caused by patch updates but cannot eliminate instance restarts.
- Kernel live patching is not a universal kernel update solution. It is only applicable to fixing CVEs of the High severity and important bugs in scenarios where you do not want to restart the instance immediately.
- During the patch update process and after the patch takes effect, you cannot use tools such as SystemTap or kprobe to test or trace the functions involved in the patch. Otherwise, the patch becomes invalid.
Live patching solution
Last updated: 2026.06.18 17:50:22
All rights reserved © Beijing Volcano Engine Technology Co., Ltd2024
