Use Oracle Ksplice to apply critical security patches to Linux kernels on Oracle Cloud Infrastructure instances without requiring a reboot. On Oracle Linux, Ksplice also updates the glibc and OpenSSL user space libraries, applying critical security patches without disrupting workloads.
What does Ksplice update?
The kernel with critical security patches
glibc and OpenSSL user space libraries with critical security patches (Oracle Linux only)
Do I need to continue regular maintenance updates?
Yes, continue to apply updates to your entire system at regular intervals based on your organization's best practices.
Ksplice updates occur in-memory, effectively making the change immediate without a reboot. This is different than a traditional kernel update, which requires a reboot to update the system. Ksplice applies critical security patches, but there are other errata updates and bug fixes you should apply at regular intervals. See Maintaining the System for more information.
Some information sources reference Ksplice Uptrack clients and the uptrack command. You can optionally use the ksplice command in place of the uptrack command to manage kernel updates and patches. For exploit detection and userspace updates, consider using the Enhanced Client instead.
Installing Ksplice π
Do I need to install Ksplice?
Oracle Linux platform instances on Oracle Cloud Infrastructure have Ksplice already installed (unless created before August 25, 2017).
You only need to install Ksplice if using:
Oracle Linux platform images created before August 25, 2017
Your own Oracle Linux image (BYOI)
Supported third-party Linux distributions (Ubuntu)
Note
Oracle no longer maintains Ksplice patches for RHEL kernels. If the instance is running RHEL, you must switch to RHCK to use Ksplice kernel patches. See Kernels Actively Maintained with Ksplice.
Do I need to register with ULN?
You don't need to register through ULN to use Ksplice on Oracle Cloud Infrastructure. Systems running on Oracle Cloud Infrastructure have automatic access to the Ksplice servers and all Ksplice updates.
No additional configuration is required. Ksplice is already installed and configured by default to run automatic updates.
For Other Linux Instances
Set the value of autoinstall to yes in /etc/uptrack/uptrack.conf.
Running Ksplice π
To install available updates, use the ksplice upgrade command with the -y option. For example:
sudo ksplice -y all upgrade
If you have enabled automatic Ksplice updates, you don't need to run the upgrade command as this action is performed regularly and automatically for you. See Enabling Automatic Oracle Ksplice Updates for more information.
Getting Help with Ksplice π
For comprehensive information about Ksplice, refer to the manual:
To display the updates and patches that Ksplice has applied to the system:
sudo ksplice all show
The output includes the effective kernel version. If no patches had been applied, then the kernel version would match the output of the uname -r command.
You can limit the output to display only the updates to specific subsystems. To display the effective kernel version:
sudo ksplice kernel show
Managing Ksplice Updates Using OS Management Hub π
OS Management Hub offers the convenience of managing and configuring Ksplice updates for managed instances whether youβre running Oracle Autonomous Linux or Oracle Linux. For more information, see Oracle Linux Package Management.
Which Kernels are Actively Maintained with Ksplice? π
Only specific kernels are actively maintained by Ksplice on Oracle Cloud Infrastructure.
Ubuntu 24.04 Noble kernels and Hardware Enablement (HWE) kernels, starting with the official release.
Kernels include 6.8 versions.
Ubuntu 22.04 Jammy kernels, starting with the official release.
Kernels include 5.15 and 6.8 versions.
Ubuntu 20.04 Focal kernels starting with 5.4.0-37.41 (released Jun 3, 2020).
Kernels include 5.4 and 5.15 versions.
Kernels No Longer Actively Maintained With Ksplice π
The following kernels don't receive Ksplice updates, but any Ksplice updates previously issued are still available.
To maintain any of the following kernels on a listed Linux distribution, you need to manually upgrade them by using the yum update or dnf update command, or in the case of Ubuntu, by using the apt command. Kernel updates that don't use Ksplice require system reboots to be effective.
If you're running any of these kernel types on either Oracle Linux 6 or Oracle Linux 7, update to the minimum version of UEK R4.