Linux Livepatching

Linux Kernel Livepatching is the process of replacing functions in the kernel code affected by CVEs with the patch-applied functions during system runtime. It's basically a method to apply security kernel patches to a running system such as a server without rebooting it. Such a feature is crucial for servers running crucial computational tasks 24/7 which cannot afford a reboot. Livepatch module is already provided by the Linux kernel but it's upto the distributions as to how they will be handled. As of 2026, only a few handful amount of distributions like SUSE, Ubuntu and RedHat offer Linux livepatches, which means no community maintained distribution at the moment offers Linux livepatches. There has been a way to utilise Linux livepatching in Debian in the past using kpatch but after the release of Debian 13 Trixie, the support for the kernel in kpatch has been dropped which halted the progress of supporting livepatching in Debian. klp-build is a promising approach to this problem but it only supports SUSE kernels which are only accessible by internal SUSE employees. Debian also lacks a release plan or mechanism to distribute livepatches for kernels. The goal of this proposal is to introduce Linux livepatching in Debian by studying how livepatches can be integrated into Debian and if existing technologies like clang-extract can be integrated into the workflow, forking klp-build to develop dlp-build which will serve as a tool to create livepatches for Debian kernels, as well as proposing a binary format for livepatches and designing a release cycle for the same.