Ubuntu Core 26 Livepatch Setup Guide: Rebootless Kernel Security Updates in 2026

Keeping your Ubuntu server secure requires regular kernel updates, but traditional kernel patching demands system reboots that cause downtime. Ubuntu Livepatch eliminates this problem by applying critical kernel security updates without requiring a reboot. In this comprehensive guide, you’ll learn how to set up Ubuntu Livepatch on Ubuntu 22.04 LTS, 24.04 LTS, Ubuntu Core 26, and the upcoming 26.04 LTS in 2026.

Whether you’re managing production servers, IoT devices, or edge infrastructure, Ubuntu Livepatch enables rebootless kernel security patching, minimizing downtime while maintaining security compliance.

What Is Ubuntu Livepatch?

Ubuntu Livepatch is Canonical’s service that applies critical kernel security updates to running Ubuntu systems without requiring a reboot. It uses kernel live patching technology to dynamically patch the Linux kernel in memory, eliminating the downtime associated with traditional kernel updates.

Ubuntu Livepatch provides:

• Zero-downtime security patching: No reboot required for most kernel vulnerabilities
• Automated patch delivery: Patches applied automatically when available
• Compliance maintenance: Stay current with security standards without scheduled maintenance windows
• Production uptime: Critical for high-availability systems

Ubuntu Livepatch Support in 2026

As of 2026, Ubuntu Livepatch supports:

• Ubuntu 20.04 LTS (Focal Fossa)
• Ubuntu 22.04 LTS (Jammy Jellyfish)
• Ubuntu 24.04 LTS (Noble Numbat)
• Ubuntu Core 26 (new in 2026)
• Ubuntu 26.04 LTS (upcoming)

Supported Architectures

• AMD64 (x86_64): Supported since Ubuntu 16.04 LTS
• ARM64 (aarch64): NEW in Ubuntu Core 26 (2026)

The addition of ARM64 support in Ubuntu Core 26 is significant for IoT devices, edge computing, and ARM-based servers like AWS Graviton.

Ubuntu Pro: Free for Personal Use

Ubuntu Livepatch requires an Ubuntu Pro subscription. However, as of 2026:

• Free for personal use: Up to 5 machines at no cost
• Free for small organizations: Up to 50 machines (community tier)
• Enterprise subscriptions: Available for large deployments

To get started, create a free Ubuntu Pro account at ubuntu.com/pro.

How to Enable Ubuntu Livepatch

Follow these steps to enable Ubuntu Livepatch on your Ubuntu server:

Step 1: Get Your Ubuntu Pro Token

1. Visit ubuntu.com/pro
2. Sign in or create a free Ubuntu One account
3. Navigate to the dashboard and copy your Ubuntu Pro token

Your token looks like:

Step 2: Attach Ubuntu Pro Subscription

On your Ubuntu server, attach your Ubuntu Pro subscription:

1
sudo ua attach YOUR_TOKEN_HERE

Example:

1
sudo ua attach C1234567890abcdef

You’ll see output confirming the subscription is attached:

1
2
3
Enabling default service esm-apps

Enabling default service esm-infra

This machine is now attached to 'Ubuntu Pro'

Step 3: Enable Livepatch

Enable the Livepatch service:

1
sudo ua enable livepatch

Output:

1
2
3
One moment, checking your subscription first

Livepatch enabled.

Kernel has already been patched. Livepatch is active.

Step 4: Verify Livepatch Status

Check that Livepatch is running:

1
sudo ua status

Look for Livepatch in the service list:

1
2
3
4
SERVICE          ENTITLED  STATUS    DESCRIPTION

esm-apps         yes       enabled   Expanded Security Maintenance for Applications

esm-infra        yes       enabled   Expanded Security Maintenance for Infrastructure

livepatch        yes       enabled   Canonical Livepatch service

Check detailed Livepatch status:

1
sudo canonical-livepatch status

Output shows patch status:

1
2
3
4
5
6
7
8
client-version: 10.2.3

machine-id: 1234567890abcdef

machine-token: active

architecture: x86_64

kernel: 5.15.0-91-generic

status: kernel patched

  Patched 3 CVEs

  Last check: 2 hours ago

Ubuntu Core 26 Livepatch Setup

Ubuntu Core 26 is Canonical’s IoT/embedded Ubuntu variant released in 2026. Setting up Livepatch on Ubuntu Core 26 is slightly different:

Prerequisites for Ubuntu Core 26

• Ubuntu Core 26 system (ARM64 or AMD64)
• Ubuntu Pro account and token
• Internet connectivity

Enable Livepatch on Ubuntu Core 26

Ubuntu Core uses snap-based configuration:

1
2
sudo snap install canonical-livepatch

sudo canonical-livepatch enable YOUR_TOKEN_HERE

Verify status:

1
sudo canonical-livepatch status

Ubuntu Core 26 systems now support Livepatch on ARM64, making it ideal for Raspberry Pi clusters, edge gateways, and ARM-based IoT devices.

Monitor Ubuntu Livepatch Activity

Monitor Livepatch activity to ensure patches are being applied:

Check Recent Patches

1
sudo canonical-livepatch status --verbose

This shows which CVEs have been patched:

1
2
3
4
Patched CVEs:

  CVE-2026-12345: kernel: privilege escalation

  CVE-2026-67890: kernel: memory corruption

  CVE-2026-11111: kernel: information disclosure

View Livepatch Logs

1
sudo journalctl -u canonical-livepatch -f

This shows real-time Livepatch activity as patches are applied.

When Livepatch Can’t Help: Limitations

Ubuntu Livepatch is powerful, but it has limitations:

• Major kernel updates: Livepatch handles security fixes, not major version upgrades
• Some vulnerability types: Certain kernel changes require a full reboot
• Out-of-band patches: If a patch can’t be applied live, you’ll need to reboot

When Livepatch can’t apply a patch, you’ll see:

1
2
status: kernel-upgrade-required

A reboot is required to complete the upgrade

In these cases, schedule a maintenance window to reboot the system.

Ubuntu Livepatch Best Practices for 2026

1. Use LTS Releases

Livepatch only supports LTS releases. Run Ubuntu 22.04 LTS, 24.04 LTS, or 26.04 LTS for production servers.

2. Combine with Unattended Upgrades

Livepatch handles kernel updates. Combine it with

for user-space security updates:

• Livepatch → Kernel security (no reboot)
• Unattended-upgrades → User-space packages (nginx, OpenSSL, etc.)

3. Monitor Patch Status

Regularly check

to ensure patches are being applied.

4. Plan for Required Reboots

Even with Livepatch, plan quarterly maintenance windows for:

• Major kernel updates
• Patches that can’t be applied live
• Firmware/BIOS updates

5. Use Ubuntu Pro Dashboard

The Ubuntu Pro dashboard (ubuntu.com/pro/dashboard) shows Livepatch status across all your enrolled machines.

Troubleshooting Ubuntu Livepatch

Problem: Livepatch Not Activating

Check that the service is running:

1
sudo systemctl status canonical-livepatch

If stopped, restart it:

1
sudo systemctl restart canonical-livepatch

Problem: “Not Supported” Architecture

Livepatch only supports AMD64 (x86_64) and ARM64 (aarch64). Check your architecture:

1
uname -m

Output should be

or .

Problem: Token Already Used

If you see “This token is already attached to another machine”, detach from the Ubuntu Pro dashboard or generate a new token.

Ubuntu Livepatch for Enterprise

For enterprise deployments beyond 50 machines, consider:

• Ubuntu Pro Enterprise: Unlimited machines, 24/7 support
• Landscape: Centralized management for Livepatch across fleets
• Compliance reporting: Track patch status for audits

Contact Canonical for enterprise pricing and support.

Additional Ubuntu Resources: For traditional enterprise deployments, check our general Ubuntu livepatch and service hardening tutorial and discover the Kernel 7.0 architectural innovations in Ubuntu 26.04.

Conclusion: Zero-Downtime Security with Ubuntu Livepatch

Ubuntu Livepatch transforms kernel security patching from a disruptive maintenance event into a seamless background process. With support for Ubuntu 22.04 LTS, 24.04 LTS, Ubuntu Core 26, and the upcoming 26.04 LTS, Livepatch is essential for production servers and IoT devices in 2026.

Key takeaways:

• Free for up to 5 machines with Ubuntu Pro
• Supports AMD64 and ARM64 (new in Ubuntu Core 26)
• Eliminates most kernel reboot requirements
• Essential for high-availability systems
• Combine with unattended-upgrades for complete automation

Enable Ubuntu Livepatch today to keep your servers secure without the downtime.