How to Deploy Canonical Livepatch for Kernel Vulnerability Remediation Without Rebooting

For Linux system administrators maintaining critical production infrastructure, the release of a high-severity Common Vulnerabilities and Exposures (CVE) involving the Linux kernel presents a massive operational dilemma. Applying a traditional kernel update via the apt package manager requires a full system reboot for the new kernel image to be loaded into memory. In environments demanding 99.999% high availability (e.g., core database clusters, hypervisors, or edge routing nodes), scheduling a reboot disrupts user traffic and breaches Service Level Agreements (SLAs). To eliminate this maintenance window and secure systems instantaneously, Ubuntu administrators must deploy Canonical Livepatch—a service that injects compiled security patches directly into a running kernel’s memory space without requiring a reboot.

The Architecture of Kernel Livepatching

Canonical Livepatch operates utilizing the ftrace (function tracer) framework, which is built deeply into the modern Linux kernel. When Canonical’s security engineering team identifies a critical vulnerability (such as a buffer overflow in a TCP/IP module or a privilege escalation exploit in a filesystem driver), they author a mathematically equivalent, secure C function.

This patched function is compiled into a specialized Livepatch kernel module (.ko). When the Livepatch client daemon on your Ubuntu server downloads and inserts this module, the kernel utilizes ftrace to dynamically alter the binary execution flow. It overwrites the very first instruction of the vulnerable, running function with a jump instruction. Any time a process attempts to call the vulnerable code, the CPU is instantly redirected to execute the newly injected, secure function located in the Livepatch module. The vulnerability is mitigated at wire-speed, while the server continues processing production workloads uninterrupted.

Prerequisites and Authentication

Canonical Livepatch is available for free for up to 5 machines for personal use, but enterprise deployments require an active Ubuntu Pro subscription. The service is strictly supported on Long Term Support (LTS) releases (e.g., Ubuntu 20.04 LTS, 22.04 LTS, and 24.04 LTS) running the generic or low-latency kernels.

To deploy the service, you must first obtain an Ubuntu Pro attachment token from your Canonical administration portal.

Deploying Livepatch via the Pro Client

Modern Ubuntu LTS releases include the ubuntu-advantage-tools package out of the box, which provides the pro command-line interface. To activate Livepatch on a target server, you must attach the machine to your Ubuntu Pro subscription using your token.

Execute the following command on the server, replacing the placeholder with your actual cryptographic token:

sudo pro attach C1xxxxxxxxxxxxxxxxxxxxxxxxxxxx

Upon successful attachment, the pro client will automatically evaluate your system and enable the default services included in your tier. However, if Livepatch is not automatically activated, or you are managing it discretely, you can enable it forcefully:

sudo pro enable livepatch

This command installs the canonical-livepatch snap daemon, which runs continuously in the background, checking the Canonical servers for new kernel modules and applying them autonomously.

Verifying Livepatch Status

To mathematically confirm that the Livepatch daemon is active and that your running kernel is secure against the latest known CVEs, you can query the daemon’s status directly:

canonical-livepatch status

The output will clearly indicate the current State of the client (e.g., running), the machine’s architecture, and most importantly, the specific Patch State. If a patch has been successfully injected into the kernel memory, you will see output similar to:

client-version: 10.5.5
architecture: x86_64
cpu-model: Intel(R) Xeon(R) CPU E5-2676 v3 @ 2.40GHz
last-check: 2026-08-28T14:30:00Z
boot-time: 2026-06-01T09:00:00Z
uptime: 88d 5h 30m
status:
- kernel: 5.15.0-78.85-generic
  running: true
  livepatch:
    checkState: checked
    patchState: applied
    version: 95.1
    fixes:
      - CVE-2023-32233
      - CVE-2023-3269

In this example, despite the server possessing an uptime of 88 days (and theoretically running an outdated kernel image on disk), the Livepatch engine has successfully hot-patched CVE-2023-32233 directly into RAM. The server remains highly secure without ever experiencing a millisecond of downtime.