Comparing KernelCare
to Canonical Livepatch

Like other major Linux vendors, Canonical developed its own live patching tool for Ubuntu: Livepatch. Live patching is supposed to eliminate downtime by applying critical kernel security updates instantly – without reboots or maintenance windows.

But Livepatch falls short where it matters most. Covering only 5–10% of Ubuntu CVEs, it leaves many high-risk vulnerabilities unpatched, weakening the very purpose of live patching. And despite these gaps, it comes at a steep cost.

As a stronger, more complete alternative, TuxCare’s KernelCare delivers up to 100% vulnerability coverage across multiple Linux distributions. Unlike Livepatch, it provides uninterrupted security without compromises. Let’s take a closer look at how these two solutions compare.

Our research revealed that Canonical Livepatch patches only 5-10% of all Ubuntu CVEs, leaving most vulnerabilities unaddressed. This creates a false sense of security for system administrators – while some updates are applied, critical risks remain, ultimately forcing teams to schedule reboots to fully secure their systems.

But if frequent reboots are still required, Livepatch fails to deliver on the core promise of live patching: eliminating downtime and ensuring continuous protection. Instead, administrators must still plan maintenance windows, endure service disruptions, and manage lingering security gaps – offering little real advantage over traditional patching methods.

In contrast, KernelCare provides true, comprehensive live patching. It delivers patches for every vulnerability the vendor addresses and even goes further – patching vulnerabilities the vendor does not address but that impact a large number of systems or are actively exploited in the wild.¹

¹ According to CISA’s catalog https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Live patching should eliminate the need for reboots, but most solutions fail to address critical userspace vulnerabilities. While the Linux kernel is commonly patched without reboots, OpenSSL and glibc – key components in most Linux environments – still require a full server reboot to apply security fixes. This leaves systems exposed to high-risk vulnerabilities and forces administrators to schedule disruptive maintenance windows, undermining the core benefits of live patching.

OpenSSL and glibc vulnerabilities are no less dangerous than kernel CVEs, with some leading to major security incidents in the past. Despite this, Canonical Livepatch is limited to kernel patching, offering no protection for these critical libraries. As a result, organizations must still endure downtime and security gaps, making it no better than traditional patching in practice.

To solve this problem, KernelCare provides true rebootless patching across the entire stack. It extends live patching beyond the kernel to cover critical shared libraries — ensuring continuous security without the need for reboots or downtime.

Live patching should provide continuous security, but Canonical imposes a strict time limit. Ubuntu LTS GA kernels have a sliding 13-month support window for Livepatch. If a system has not been rebooted within that period, administrators must install the latest kernel update and reboot to continue receiving live patches. This forces organizations with longer maintenance cycles to adjust their schedules or risk losing live patching support.

This limitation undermines the flexibility that live patching is meant to provide. Instead of eliminating downtime, it simply delays the need for reboots, leaving administrators constrained by Ubuntu’s release schedule.

KernelCare removes these restrictions, offering live patches with no enforced reboot deadlines. Organizations can maintain continuous protection for their existing kernels, free from artificial time limits and unnecessary reboots.

Live patching should provide flexibility, but most solutions lack a critical feature: rebootless rollback. In some cases, a patch may introduce unexpected effects in certain environments, such as the performance impact seen with Spectre and Meltdown mitigations. When alternative measures are available, administrators need the ability to revert changes seamlessly.

KernelCare solves this by enabling rollback without requiring a reboot, allowing administrators to quickly restore system stability if needed.

Canonical Livepatch, however, does not support rebootless rollbacks. If a patch needs to be reverted, administrators are forced to reboot the system, leading to costly service disruptions and limiting the effectiveness of live patching.

With a single command, KernelCare restores the previous state without downtime — giving administrators full control over their patching process.

Most live kernel patching solutions are limited to a single distribution, and Canonical Livepatch is no exception – it only supports Ubuntu systems with newer kernel versions. This works if your entire infrastructure runs on the latest Ubuntu releases, but many organizations rely on multiple distributions for different use cases, as some are better suited for specific workloads. As a result, Livepatch provides only partial coverage, leaving gaps in your live patching strategy.

KernelCare, on the other hand, eliminates these limitations by supporting a much wider range of distributions. It provides live patching for Ubuntu, Debian, RHEL, Oracle Linux, AlmaLinux, Rocky Linux, Amazon Linux, and many more – covering over 60 enterprise-grade Linux distro versions and well over 9,000 distribution-kernel version combinations.

With KernelCare, there’s no need to juggle multiple solutions. It delivers a unified, comprehensive approach to live patching, ensuring continuous protection across your entire Linux environment.

Canonical Livepatch is not the most expensive option, but it isn’t the most affordable either — and it cannot be purchased as a standalone product. Instead, it is bundled with an Ubuntu Pro subscription, requiring users to sign up through their Ubuntu One accounts.

Pricing for Livepatch ranges from $225 to $3,400 per machine, per year, depending on the subscription tier. In contrast, TuxCare’s KernelCare starts at $50 per server per year – while offering broader compatibility and comprehensive rebootless patching beyond just Ubuntu.

Switching from Canonical Livepatch to KernelCare is effortless. Installation requires only a single command-line script – just as simple as enabling Livepatch.

Once deployed, KernelCare runs silently in the background, applying security patches without disrupting operations.

For those considering the switch, KernelCare offers a 30-day free trial with full functionality – allowing you to experience uninterrupted security before committing.

Choosing the right rebootless patching solution depends on your needs. If your infrastructure consists solely of Ubuntu systems and you’re already subscribed to Ubuntu Pro, Livepatch may seem like a reasonable option – though its limitations, including restricted vulnerability coverage and exclusive focus on kernel patches, should be considered.

KernelCare offers a flexible, cost-effective solution for organizations seeking to reduce costs, support multiple Linux distributions, or maximize security. It provides up to 100% vulnerability coverage for vendor-addressed CVEs, eliminating security gaps left by other solutions. Unlike Livepatch, it extends protection beyond the kernel to critical userspace libraries – without requiring reboots.

With more comprehensive patching, broader compatibility, and lower cost, KernelCare fully delivers on the core promise of rebootless patching – minimizing downtime, reducing security risks, and simplifying operations.