Docs

Elastic Compute Service

Kernel live patching

Using kernel live patches

This topic describes how to obtain, enable, and manage kernel live patches.

Prerequisite

Your operating system is configured with the VolcanoEngine software repository.

Procedure

Obtain and install kernel live patches

Kernel live patches provided by VolcanoEngine are released as livepatch packages and included in the VolcanoEngine software repository.

Execute the following command to view the kernel version of the current operating system.

uname -r

When the following output is displayed, the kernel version numbers are 5.4.250-6.ve1 and 5.4.250-9-velinux1.

Execute the following command to query the kernel live patch applicable to the current operating system.

veLinux

sudo apt update
sudo apt-cache search livepatch | grep "<kernel version number>"

veLinux CentOS Compatible

sudo yum makecache
sudo yum list | grep "livepatch" | grep "<kernel version number>"

Sample output:

Naming format for DEB/RPM packages of kernel live patches: livepatch-${kernel_version}-${package_name}. Where:

${kernel_version} specifies the kernel version number matched by the live patch. You can use the live patch only when the kernel version of your operating system is the same as this version number. You can execute the uname -r command in the instance to view the kernel version information.

${package_name} specifies the name of the live patch package.

Execute the following command to install the live patch.

veLinux

sudo apt -y install <livepatch>

veLinux CentOS Compatible

sudo yum -y install <livepatch>

tip

Replace <livepatch> with the name of the DEB/RPM package of the target live patch.

Execute the following command to check whether the live patch is installed.

sudo lsmod | grep livepatch

If the following output is displayed, the live patch is installed.

Related action

Delete kernel live patches

If a live patch does not take effect or the instance performance is affected after you enable the live patch, you can delete the live patch to resolve the issues.

Execute the following command to view the enabled live patch package.

veLinux

dpkg-query -W | grep "livepatch"

veLinux CentOS Compatible

sudo yum list installed | grep "livepatch"

Sample output:

Execute the following command to delete the anomalous live patch package.

veLinux

sudo apt -y remove livepatch-5.4.250-6.ve1-ext4-ABBA-lock-fix.x86_64

veLinux CentOS Compatible

sudo yum -y remove livepatch-5.4.250-6.ve1-ext4-ABBA-lock-fix.x86_64

tip

Replace livepatch-5.4.250-6.ve1-ext4-ABBA-lock-fix.x86_64 with the actual patch package name.

When the following output is displayed, the livepatch-5.4.250-6.ve1-ext4-ABBA-lock-fix.x86_64 live patch package has been deleted.

Execute the following command to check whether the target live patch package has been deleted.

sudo lsmod | grep livepatch-5.4.250-6.ve1-ext4-ABBA-lock-fix.x86_64

tip

Replace livepatch-5.4.250-6.ve1-ext4-ABBA-lock-fix.x86_64 with the actual patch package name.

If the output is empty, the live patch package has been deleted.

Disable the livepatch system service

If your kernel live patch is installed and effective, but you want the operating system not to automatically load all kernel modules of the live patch when the ECS instance restarts, you can perform the following steps to disable the livepatch system service.

Execute the following command to check whether the livepatch system service has started.

sudo systemctl is-enabled livepatch.service

Sample output:

If enabled is displayed in the output, the livepatch system service has started, and you can proceed to the next steps to disable the service.

Execute the following command to disable the livepatch system service.

sudo systemctl disable livepatch.service

If the following output is displayed, the livepatch system service has been disabled.

Execute the following command to view the status of the livepatch system service.

sudo systemctl status livepatch.service

If the following output is displayed, the livepatch system service has been disabled.

Subsequently, you can execute the following command to re-enable the livepatch system service.

sudo systemctl enable livepatch.service

When the following output is displayed, the livepatch system service has been re-enabled.

Last updated: 2025.09.01 18:20:46