Do we really want more runtime patching? [LWN.net]

Do we really want more runtime patching?

Posted May 8, 2026 15:47 UTC (Fri) by MarcB (subscriber, #101804)
Parent article: killswitch for short-term emergency vulnerability mitigation

For servers and other "well defined systems", disabling modules, after all the needed ones are loaded, seems like a better choice.

This would also obviously clash with lockdown, but it might make sense for systems that truly need dynamic module loading.

I also wonder why something like AF_ALG is even enabled on any non-hardware-specific kernel. Absent old crypto accelerators, everything it does can be done equally well (or better) in user space.

to post comments

Do we really want more runtime patching?

Posted May 8, 2026 17:42 UTC (Fri) by gus3 (guest, #61103) [Link] (2 responses)

> For servers and other "well defined systems", disabling modules, after all the needed ones are loaded, seems like a better choice.

Not just disable modules. Unmount them as well.

There are more options than just the usual ones that you read about.

Do we really want more runtime patching?

Posted May 8, 2026 18:43 UTC (Fri) by MarcB (subscriber, #101804) [Link] (1 responses)

With disabling modules, I mean /sbin/sysctl -w kernel.modules_disabled = 1, as soon as all relevant modules are loaded at boot.

For what it's worth, we now reconfigured some test systems that way. We had to explicitly load some modules early (before, they were loaded on demand). It seems viable, at least in a virtualized environment.

Do we really want more runtime patching?

Posted May 9, 2026 5:24 UTC (Sat) by PlaguedByPenguins (subscriber, #3577) [Link]

FWIW our HPC systems have disabled module loads for years. maybe a decade.

# no more module loads...
echo 1 > /proc/sys/kernel/modules_disabled

# there's also no point in khelper calling out to modprobe
echo > /proc/sys/kernel/modprobe

Do we really want more runtime patching?

Posted May 8, 2026 20:54 UTC (Fri) by DemiMarie (subscriber, #164188) [Link] (1 responses)

Lockdown could be preserved by creating an allowlist of safe patches.

Do we really want more runtime patching?

Posted May 11, 2026 0:55 UTC (Mon) by cypherpunks2 (guest, #152408) [Link]

There's no such thing as a list of "safe patches". You don't know what functions need to be disabled until a new vulnerability is made public.

Lockdown is preserved simply by disabling killswitch when lockdown is enabled.