# KernelCare kcarectl Commands: Licence, Patches, Unload and Uninstall (Tested)

Source: https://srvscripts.com/guides/kernelcare-kcarectl-commands-license-uninstall/
Updated: 2026-10-11
Publisher: srvScripts (https://srvscripts.com/)

**Short answer:** install with `curl -s -L https://kernelcare.com/installer | bash`. Register a key with `kcarectl --register KEY`; IP-based licences need no registration. Apply patches with `kcarectl --update` and confirm with `kcarectl --info` (`kpatch-state: patch is applied`) and `kcarectl --uname`, which shows the effective, patched kernel version. Remove the patches with `kcarectl --unload`, then `dnf remove kernelcare`, and delete the three folders and the repo file it leaves behind.

We ran everything on this page on our cPanel lab server (AlmaLinux 9.8, kernel 5.14.0-687.53.1.el9_8, cPanel 138) on 11 October 2026 with KernelCare 3.9, using the 7-day IP trial that KernelCare requested by itself. We did not test a paid key, because we have none; the key commands are from TuxCare’s documentation. For panel-specific setup, see [KernelCare setup on cPanel and DirectAdmin](/guides/kernelcare-setup-cpanel-directadmin/).

## kcarectl commands quick reference

| Task | Command | What we saw |
| --- | --- | --- |
| Install | curl -s -L https://kernelcare.com/installer | bash | 73 seconds; installed kernelcare-3.9-1.el9 |
| Version | kcarectl --version | 3.9-1.el9 |
| Register a key | kcarectl --register KEY | From TuxCare’s docs |
| Licence status | kcarectl --license-info | You have a trial license for the IP ... that will expire on 2026-10-18 |
| Apply patches now | kcarectl --update | Patch level 3 applied. Effective kernel version 5.14.0-687.54.1.el9_8 |
| Patch state | kcarectl --info | kpatch-state: patch is applied |
| Effective kernel | kcarectl --uname | 5.14.0-687.54.1.el9_8; uname -r still shows the booted kernel |
| Patched CVEs | kcarectl --patch-info | grep CVE- | 6 CVE entries on our kernel |
| Remove all patches | kcarectl --unload | KernelCare protection disabled. Your kernel might not be safe |
| Release a key licence | kcarectl --unregister | On an IP trial: Error unregistering server: cannot find server id |
| Uninstall | dnf remove kernelcare | yum remove kernelcare on older systems |

Run `kcarectl --help` for the full list. Version 3.9 also has `--status`, `--check`, `--smart-update`, `--auto-update` and the userspace (`--userspace-*`) and library (`--lib-*`) patching options.

## Install

```
curl -s -L https://kernelcare.com/installer | bash
# or download, read, then run:
curl -fsSL -o kernelcare_install.sh https://kernelcare.com/installer
less kernelcare_install.sh
bash kernelcare_install.sh
```

`https://kernelcare.com/installer` redirects to `repo.cloudlinux.com/kernelcare/kernelcare_install.sh` (installer v1.30 on our test day). An older address you may still see in guides, `repo.cloudlinux.com/kernelcare/kc-install.sh`, returned `404`. The installer adds `/etc/yum.repos.d/kernelcare.repo` and the TuxCare signing key, installs the `kernelcare` package, and turns on automatic updates (`AUTO_UPDATE=True` in `/etc/sysconfig/kcare/kcare.conf`). Patches are then checked every four hours.

## Licence: key, IP and the automatic trial

```
kcarectl --register YOUR_KEY     # key-based licence
kcarectl --license-info          # what the server is licensed for
```

An **IP-based licence** needs no registration: TuxCare’s activation guide says nothing else is required. Do not run `kcarectl --register` without a key; it only fails with `error: argument --register: expected one argument`.

With **no licence at all**, `kcarectl --update` on our lab printed `Requesting trial license for IP ... Please wait...` and got a 7-day trial for the server’s IP by itself.

A **new licence can take a few minutes** to work. Right after the trial was granted, `--update` kept failing with:

```
HTTP Error 401: Unauthorized: https://patches.kernelcare.com/patches/.../kpatch.bin
```

A few minutes later the same command applied the patches. TuxCare’s own explanation for a lasting 401 is an expired licence, or a server that was removed from CloudLinux Network (CLN). Check `kcarectl --license-info`, and re-register with your key if the licence is key-based.

To move a key licence to a new server, run `kcarectl --unregister` on the old one and `kcarectl --register KEY` on the new one. IP licences follow the IP, so change them in your CLN or provider account.

## Apply and verify patches

```
kcarectl --update                 # Patch level 3 applied. Effective kernel version 5.14.0-687.54.1.el9_8 / Kernel is safe
kcarectl --info                   # kpatch-state: patch is applied
kcarectl --uname                  # 5.14.0-687.54.1.el9_8 (effective)
uname -r                          # 5.14.0-687.53.1.el9_8.x86_64 (booted, unchanged)
kcarectl --patch-info | grep -E '^kpatch-cve'
```

The difference between `kcarectl --uname` and `uname -r` is the point of live patching. Security scanners that read `uname -r` will still report the old kernel, and KernelCare installs `kcare-uname` for tools that can use it. With patches loaded, `lsmod` lists the `kcare` module. To stop automatic patching, set `AUTO_UPDATE=False` in `/etc/sysconfig/kcare/kcare.conf`.

## Unload patches and uninstall

```
kcarectl --unload            # remove the live patches (protection off)
kcarectl --unregister        # key licences only
dnf remove kernelcare        # yum remove kernelcare on older systems
```

After `--unload`, `kcarectl --info` went back to `No patches applied` and the `kcare` module was gone. After `dnf remove kernelcare`, these were still on the server:

| Leftover | Size | Remove with |
| --- | --- | --- |
| /etc/sysconfig/kcare (config and blacklists) | 12 KB | rm -rf /etc/sysconfig/kcare |
| /usr/libexec/kcare | 320 KB | rm -rf /usr/libexec/kcare |
| /var/log/kcarectl.log | 24 KB | rm -f /var/log/kcarectl.log |
| /etc/yum.repos.d/kernelcare.repo | Repository | rm -f /etc/yum.repos.d/kernelcare.repo |
| rpm key gpg-pubkey-80935b88 (KernelCare Packages) | Signing key | rpm -e gpg-pubkey-80935b88 |

With those removed, our lab’s package count was back to exactly what it was before the install. Removing KernelCare does not change the booted kernel: reboot into an updated kernel from your normal package updates to stay protected.

## Common problems

- **HTTP Error 401: Unauthorized on --update.** Right after a new licence, wait a few minutes and retry. If it persists, check `--license-info` and re-register the key.

- **“argument --register: expected one argument”.** You ran `--register` without a key. IP licences do not need it.

- **The vulnerability scanner still reports the old kernel.** Scanners read `uname -r`. Show them `kcarectl --uname` or `kcare-uname`, or reboot into the new kernel.

- **The installer URL gives 404.** Use `https://kernelcare.com/installer`; the old `kc-install.sh` address no longer works.

- **Folders are left after uninstalling.** `dnf remove` leaves the config, libexec folder, log, repo file and key; see the table above.

## Frequently asked questions

### How do I check that KernelCare is working?

Run kcarectl --info and look for kpatch-state: patch is applied, then kcarectl --uname, which shows the effective kernel version after patching. uname -r keeps showing the kernel you booted.

### Do I need to run kcarectl --register for an IP-based licence?

No. TuxCare says nothing else is required for IP-based licences. kcarectl --register expects a key, and without one it fails with expected one argument.

### Why does kcarectl --update return HTTP Error 401 Unauthorized?

The licence is not valid for the server yet or any more. On our lab a newly granted trial gave 401 for a few minutes and then worked. If it lasts, check kcarectl --license-info and re-register your key.

### How do I uninstall KernelCare?

Run kcarectl --unload to remove the live patches, kcarectl --unregister for a key licence, then dnf remove kernelcare. Afterwards delete /etc/sysconfig/kcare, /usr/libexec/kcare, /var/log/kcarectl.log and /etc/yum.repos.d/kernelcare.repo.

### Does KernelCare give a free trial?

On our lab, running kcarectl --update with no licence requested a 7-day trial for the server’s IP automatically. TuxCare also offers trials through its website.