CloudLinux quantifies the cost of kernel patch reboots

CloudLinux published an analysis on 21 October 2026 on its blog that attempts to price, line by line, the reboot required after a Linux kernel security patch. For those managing shared hosting or VPS, the issue is far from academic: every scheduled reboot means client notification, out-of-hours shifts and days when the vulnerability remains open on the production kernel.

The figures cited by CloudLinux

Exabytes handled Dirty COW in 2016 in the same way, when the privilege escalation vulnerability in the Linux kernel hit its shared hosting servers: it booked a three-hour window and rebooted servers one by one to load the correct kernel, on 29 October, around 10 days after the vulnerability was publicly disclosed. The provider TrueCore Hosting, cited in the same post, notifies customers at least 48 hours before scheduled maintenance and reports that a reboot takes 2–5 minutes per server, except in emergencies and zero-day situations.

The post calculates the impact on an exemplary fleet of 40 servers:

Item	Value
Kernel vulnerabilities tracked by CloudLinux (Apr–Aug 2026)	13 in approximately 110 days
Reboot duration per server (TrueCore data)	2–5 minutes
Estimated reboot cycles annually (1 in 3 vulnerabilities requires restart)	12–14
Total reboot hours annually across 40 servers	16–40
Downtime experienced per customer account annually	24–60 minutes
Time from disclosure to reboot (Dirty COW, Exabytes 2016)	approximately 10 days

What's not covered

KernelCare's rebootless patching acts only on the kernel: a vulnerability in glibc or OpenSSL still requires restarting the services that load those libraries, unless KernelCare+ is activated, which is licensed separately. A major operating system upgrade remains a reboot in every respect. Vulnerability scanners that only read package version can report a kernel as unpatched even if already corrected in memory: KernelCare integrates with Qualys, Nessus, OpenSCAP and Rapid7 so scanners can read the actual patch state.

Pricing and coverage

KernelCare pricing starts at $3.95 per server per month, with volume discounts available for larger fleets, according to CloudLinux's official price list verified today. The same page states 59 distro versions supported, 10,762 Linux kernels supported, 5,364 vulnerabilities patched and 269,100 patches deployed live.

To enable rebootless patching on a server: curl -s -L https://kernelcare.com/installer | bash, then kcarectl --register YOUR_KEY and kcarectl --update. To check status: kcarectl --uname shows the actual version of the patched kernel, kcarectl --patch-info lists the loaded patches.