Kernel vulnerabilities are serious, and fixing them normally needs a reboot, which means downtime for every site on the server. KernelCare, from the makers of CloudLinux, applies kernel security patches to the running kernel, so servers stay patched without rebooting for each fix.
MdmHost manages this on its hosting plans. This guide is for administrators of their own server with root access.
Before you start
- A supported Linux server (CloudLinux, AlmaLinux, Rocky Linux and others) with root access.
- A KernelCare licence key, or an IP-based licence.
Install KernelCare
curl -s -L https://kernelcare.com/installer | bashRegister with your key (skip this for IP-based licences):
/usr/bin/kcarectl --register YOUR_KEYKernelCare downloads and applies available patches immediately, then checks for new ones automatically several times a day.
Check the status
kcarectl --info
kcarectl --uname--info shows the patch level applied; --uname shows the effective kernel version after patches, which differs from uname -r because the installed kernel package has not changed.
What it covers and what it does not
| Covered | Not covered |
|---|---|
| Security fixes for the running kernel | Userland packages: OpenSSL, PHP, MySQL, cPanel |
| No reboot needed for those fixes | Moving to a new major kernel or OS version |
| Automatic updates | Library updates that need service restarts |
Keep normal package updates running (see cPanel and OS updates). Related products from the same vendor patch shared libraries in memory, but that is a separate service.
Tip: Plan an occasional reboot anyway, for example during a quarterly maintenance window, to boot into the latest installed kernel package and confirm the server starts cleanly.
KernelCare and Security Advisor
WHM's Security Advisor warns when the running kernel is outdated. With KernelCare active, cPanel recognises the patched state on supported setups (see Security Advisor).
Troubleshooting
"Unknown kernel" message
Patches are not yet available for a very new or custom kernel. Boot a supported kernel or wait for KernelCare support.
Patches not applying after a kernel update
After installing a new kernel package, reboot into it; KernelCare then patches the new kernel.
How CloudLinux itself is installed is in installing CloudLinux.
Frequently asked questions
Does MdmHost hosting need KernelCare from me?
No. Server kernels are maintained by MdmHost. This guide is for your own servers.
Can I unload patches?
Yes, kcarectl --unload removes applied patches, returning to the original kernel code. Use it only for troubleshooting.
Is a reboot ever required?
For new major kernels or OS upgrades, yes. Security patches within a kernel series are applied live.
How do I check KernelCare is updating automatically?
Look for the KernelCare cron job in /etc/cron.d/ and check kcarectl --info periodically for a recent patch level.
Does KernelCare work on VPS servers?
It works on most KVM-based virtual servers with supported kernels. Container-based VPS types share the host kernel, so live patching is the provider's job there.
What does it cost?
KernelCare is a paid licence per server; check the vendor for current pricing and trials.