What Exactly is Oracle KSplice?

KSplice Inc. was, alongside KernelCare, one of the pioneers of live Linux kernel patching services. KSplice is short for kernel splicing, the service was created by four MIT students in 2009. Like other live patching solutions for Linux kernels such as Red Hat Enterprise Linux, the original KSplice Uptrack did its magic by swapping in updated kernel code with the latest patches, without the need to restart the entire OS instance to apply the patch.

In 2011, KSplice saw a major change in direction as it was acquired by Oracle, and the company intended to use it alongside its own Unbreakable Linux kernel – a major competitor to the established Red Hat Enterprise Linux. It had a significant impact on the direction of KSplice, and essentially locked it to Oracle’s Linux Premier Support customers, and Oracle’s support pricing.

Supported Kernels

Fundamentally, as a live patching service and to minimize security vulnerabilities, KSplice is terrific. It has a long, proven history of delivering reliable live Linux kernel patching from the days of KSplice Uptrack.However, as mentioned earlier, it’s availability is limited to existing customers of Oracle’s premium support plans and is restricted to Oracle Linux, Red Hat, and Ubuntu systems. Additionally, customers running Red Hat Enterprise Linux must switch to an Oracle-provided Red Hat Compatible Kernel (RHCK) and reboot the system before they can apply Ksplice patches, which is a significant limitation.

This service works well for those using Oracle Linux with Premier Support. However, if you operate with a mix of other distributions, such as CentOS, Debian, AlmaLinux, and others, and are not prepared to pay for expensive support, you’ll be better off driving kernel live patching through KernelCare Enterprise, which supports all of these and many more.

Comparing Pricing

KSplice kernel patching is available exclusively with an Oracle Linux Premier Support subscription. The high subscription price per machine can rule out KSplice for some types of workloads.On the flip side, if your requirements demand that you pay for an Oracle Linux Premier subscription anyway, KSplice is included in that package. However, it’s important to note that this does not extend to other Linux-based systems you may be using.

KernelCare, on the other hand, offers affordable pricing at under $50 per year per system, which is a fraction of the $1,399 per annum cost of Oracle Linux Premier Support. It doesn’t tie you into an expensive support contract you don’t need – and you can opt for affordable monthly pricing.

Vulnerability Coverage

Vulnerability coverage is also a crucial factor as we evaluate the broader implications of choosing between Ksplice and KernelCare Enterprise. Ksplice is designed to address only high and critical CVEs (Common Vulnerabilities and Exposures), which naturally are top priorities. However, Oracle sometimes adjusts the severity scores provided by the National Vulnerability Database based on its own criteria. This means Ksplice might overlook some vulnerabilities that are considered high and critical by other standards but could still pose significant risks depending on your specific setup or security requirements.

In contrast, KernelCare provides live patches for all vulnerabilities vendors have addressed with traditional patches. It also covers those vulnerabilities that vendors did not patch but that are still significant, impacting numerous systems, or known to be exploited in the wild.

Choosing between KernelCare and Oracle KSplice

Organizations running their systems on Oracle Linux and subscribing to Oracle’s Premier Support can continue to benefit from live patching with Ksplice. For others, the broader reach, wider vulnerability coverage, and significantly lower price of KernelCare Enterprise are likely to be more appealing.

Transitioning From KSplice Kernel Patching to KernelCare

If you’re currently using the KSplice client, you can easily transfer to the KernelCare Enterprise solution; just run a script on the system, and you’re done. It’s no more challenging than installing Uptrack used to be. KernelCare Enterprise then takes care of live patching of the kernel and indeed many other services on that machine.

If you’re still unsure, why not give it a try? KernelCare is available as a 30-day trial, with full functionality and no commitment to buy.