SLES Live Patching Configuration Guide: Apply Kernel Updates Without Rebooting

What SLES live patching does

SUSE Linux Enterprise Server (SLES) Kernel Live Patching (KLP) applies supported kernel fixes to a running system without restarting it. On SLES 15 SP7, SUSE delivers these fixes as kernel live patch packages that match a specific kernel revision. The uname -r output therefore stays the same after a successful live patch; use the KLP tools to confirm patch status.

Live patching reduces the need for immediate maintenance reboots, but it does not eliminate kernel reboot planning. Live patches cover selected critical fixes; they do not replace regular kernel updates, service-pack maintenance, or reboot-required fixes. SUSE may not be able to create a live patch for every eligible fix. Keep a scheduled reboot path for installing a newer base kernel and applying fixes that cannot be patched in place.

This guide follows the SLES 15 SP7 procedure published in SUSE’s Kernel Live Patching with KLP administration guide. Check the documentation for your exact service pack and architecture before applying commands to a production host.

Quick reference

Before enabling KLP

• Confirm the host runs a supported SLES 15 service pack and architecture. The SP7 procedure below uses the x86_64 extension example; read the extension output on your own host rather than copying a different product or architecture path.
• Make sure both the SLES subscription and the separate SLE Live Patching entitlement are active, and obtain the Live Patching registration code from SUSE Customer Center.
• Confirm the host can reach its configured SUSE repositories or your organization’s mirrored update service. For managed fleets, verify that repository channels include the matching live patch content.
• Record uname -r, recent system health, and the current maintenance plan. Test the procedure on a representative non-production server when possible.
• Keep the normal kernel update and reboot process in place. Live patching reduces urgency for some fixes; it does not make a running kernel current indefinitely.

Enable SLES 15 SP7 kernel live patching

1. Check the available extension command

Run the extension listing and locate the exact SLE Live Patching entry for the installed product:

sudo SUSEConnect --list-extensions

For SLES 15 SP7 on x86_64, SUSE documents an activation path like sle-module-live-patching/15.7/x86_64. The output on your host is authoritative: confirm the version and architecture match before continuing.

2. Register the Live Patching extension

Use the activation command shown by SUSEConnect --list-extensions, substituting your valid registration code. Example for SLES 15 SP7 x86_64:

sudo SUSEConnect -p sle-module-live-patching/15.7/x86_64 \
  -r LIVE_PATCHING_REGISTRATION_CODE

Do not paste a real registration code into shared tickets, shell transcripts, or public logs. If registration fails, check the code, subscription status, product path, network access, and whether the machine is already registered to the expected SUSE Customer Center organization.

3. Install the required pattern

Install the Live Patching software pattern and dependencies:

sudo zypper install -t pattern lp_sles

Review Zypper’s proposed changes before confirming. The pattern installs the base KLP components and the initial live patch. When the package manager finds a live patch for the running kernel in an enabled repository, the running kernel can be patched during package installation. Whether a fix is available depends on the exact kernel revision and repository content.

Apply updates and verify the result

After activation, install live patch packages through the regular SLES update process. First refresh repository metadata and review available patches. Then apply updates according to your organization’s normal change controls, for example:

sudo zypper refresh
sudo zypper patch

Read the proposed transaction carefully. Live patch packages for the running kernel can be installed without rebooting, but a regular kernel package update may still prompt for a reboot. Do not suppress that prompt or lock kernel updates as a permanent workaround. If a newer base kernel is installed, plan a controlled restart to begin running it and complete the kernel maintenance cycle.

Verify the live patch independently from the kernel release string:

uname -r
sudo klp status
sudo klp -v patches
zypper se --details 'kernel-livepatch-*'

Use klp status for the operational state and klp -v patches for patch details, including fixes addressed by the active patch. SUSE notes that uname -r does not change for a patched kernel. Installed package presence alone is not sufficient proof that the expected patch is loaded; check the KLP status output.

Operational limits and reboot decisions

• Coverage is selective. SUSE’s stated scope includes SUSE CVSS level 7 and higher vulnerabilities and stability or data-corruption fixes, but technical constraints mean not every qualifying issue receives a live patch.
• Patches are kernel-specific and cumulative. A live patch package targets an exact kernel revision. The newest package for one kernel does not automatically patch another kernel revision.
• Base kernel updates still matter. Live patches are temporary protection for selected fixes. Regular kernel updates may require a reboot and deliver other changes.
• Support has an expiration window. The SLES 15 SP7 guide says live patches receive updates for 13 months from release of the underlying kernel package. Check current dates with lifecycle data and SUSE’s current live patch and maintained kernel table.
• Not all architectures or products share the same commands. The SLES 15 SP7 KLP guide identifies AMD64/Intel 64, POWER, and IBM Z. Confirm your product-specific guide and subscription entitlement before rollout.

Troubleshooting checklist

If a newly installed live patch appears to cause a problem, pause further rollout and inspect kernel logs and service health. SUSE documents a manual downgrade path for suitable systems, but warns that hosts already showing kernel warnings or error traces may not be appropriate candidates. Use the matching patch package version and contact SUSE Support when system state is uncertain; avoid improvising a downgrade on a production kernel.

Rollout checklist

1. Validate the SLES service pack, architecture, subscriptions, and repository channels.
2. Record the running kernel and baseline host health.
3. Register the SLE Live Patching extension and install lp_sles.
4. Apply updates through the normal package workflow and review each transaction.
5. Confirm the loaded patch with klp status and klp -v patches.
6. Track patch lifecycle dates and schedule regular base-kernel reboots.

For fleet administration, use your organization’s tested SUSE management workflow and confirm that channels expose the matching live patch packages. The official SUSE Multi-Linux Manager channel setup documentation describes channel preparation for SLES 15 SP7.