Reinventing live patching? [LWN.net]

Reinventing live patching?

Posted Jul 14, 2026 13:17 UTC (Tue) by zhalas (subscriber, #114013)
In reply to: Reinventing live patching? by siddh
Parent article: Shielding running kernels against exploits with BPF

As far as I understand, they want to use it as a temporary mitigation. They claim that live patching is not viable for them in the short term due to the huge number of kernel variations they have.
I'm not sure, though, how they envision validating the temporary mitigation. I mean, blocking syscalls is easy, but validating that the product works across such a variety - less so.

to post comments

Reinventing live patching?

Posted Jul 14, 2026 13:47 UTC (Tue) by siddh (subscriber, #169663) [Link]

I agree. If some old kernel uses the error return value for something or the function logic is different, then the "mitigation" might not suffice alone. So you end up having to test for each kernel, and at that point I'm not sure if the "temporary" fix is worth it.

Variations are a non-issue technically, so it seems the claim is more due to a business decision to not have a livepatching solution.

Also, temporary is an alias for permanent in many settings :-P