Knowledgebase

Optional live kernel patching for dedicated servers and VPS instances — automate kernel security updates without requiring server reboots.

What is KernelCare?

KernelCare by TuxCare is an optional live kernel patching service that allows Linux servers to receive security patches without rebooting the system. Instead of requiring downtime after every kernel update, patches are applied directly to the running kernel in memory.

This helps administrators:

• Apply critical kernel security updates without downtime

• Keep systems protected against newly discovered vulnerabilities

• Reduce maintenance windows and reboot-related interruptions

• Automate kernel patch management

KernelCare automatically checks for and applies updates every 4 hours by default.

Compatibility

KernelCare supports many modern 64-bit Linux distributions, including:

• CentOS 7

• AlmaLinux 8 / 9

• Rocky Linux 8 / 9

For the latest supported kernels and operating systems, check the official TuxCare compatibility list:

Supported Kernels List

Supported Virtualization Types

Recommended virtualization platforms include:

• KVM

• Xen

• VMware

• Bare metal / dedicated servers

OpenVZ container environments are not directly supported at the VPS container level.

How Kernel Updates Normally Work

Without live patching, Linux kernel updates typically require:

1. Updating the kernel package via YUM or DNF

2. Rebooting the server to load the new kernel

This can result in downtime for websites, applications, and connected users.

KernelCare eliminates the reboot requirement by patching the running kernel directly in memory.

Installation

KernelCare offers a free trial period. After the trial expires, a paid license is required to continue receiving updates.

Step 1 — Obtain a License Key

Register for an account and obtain a license key from:

TuxCare Official Website

Step 2 — Install KernelCare

Run the installer via SSH:

curl -s https://repo.cloudlinux.com/kernelcare/kernelcare_install.sh | bash

Step 3 — Register Your License

Replace YOURKEY with your actual license key:

kcarectl --register YOURKEY

KernelCare will then automatically check for new patches every 4 hours.

Configuration

The main configuration file is located at:

/etc/sysconfig/kcare/kcare.conf

Default automatic update setting:

AUTO_UPDATE=True

Common Commands

Check Installed Version

kcarectl --version

Manually Check and Apply Updates

kcarectl --update

Show Patch Status

kcarectl --info

Example output:

kpatch-state: patch is applied

View Detailed Patch Information

kcarectl --patch-info

This command displays applied security patches, CVE identifiers, and CVSS scores.

Kernel Version Information

KernelCare does not replace the original kernel version shown by uname -r.

Show Original System Kernel

uname -r

Show Patched KernelCare Version

kcare-uname -r

This displays the live-patched kernel version currently running in memory.

Command Reference

Uninstalling KernelCare

To remove KernelCare:

yum remove kernelcare -y

After removal, future kernel updates will again require server reboots.