Short answer: install with curl -s -L https://kernelcare.com/installer | bash. Register a key with kcarectl --register KEY; IP-based licences need no registration. Apply patches with kcarectl --update and confirm with kcarectl --info (kpatch-state: patch is applied) and kcarectl --uname, which shows the effective, patched kernel version. Remove the patches with kcarectl --unload, then dnf remove kernelcare, and delete the three folders and the repo file it leaves behind.
Applies to kernelcare 3.9-1.el9 (installer v1.30); kernel 5.14.0-687.53.1.el9_8 patched to effective 687.54.1; AlmaLinux 9.8 + cPanel 138; lab test 11 Oct 2026 with an IP trial licence
We ran everything on this page on our cPanel lab server (AlmaLinux 9.8, kernel 5.14.0-687.53.1.el9_8, cPanel 138) on 11 October 2026 with KernelCare 3.9, using the 7-day IP trial that KernelCare requested by itself. We did not test a paid key, because we have none; the key commands are from TuxCare’s documentation. For panel-specific setup, see KernelCare setup on cPanel and DirectAdmin.
Table of Contents
kcarectl commands quick reference
| Task | Command | What we saw |
|---|---|---|
| Install | curl -s -L https://kernelcare.com/installer | bash | 73 seconds; installed kernelcare-3.9-1.el9 |
| Version | kcarectl --version | 3.9-1.el9 |
| Register a key | kcarectl --register KEY | From TuxCare’s docs |
| Licence status | kcarectl --license-info | You have a trial license for the IP ... that will expire on 2026-10-18 |
| Apply patches now | kcarectl --update | Patch level 3 applied. Effective kernel version 5.14.0-687.54.1.el9_8 |
| Patch state | kcarectl --info | kpatch-state: patch is applied |
| Effective kernel | kcarectl --uname | 5.14.0-687.54.1.el9_8; uname -r still shows the booted kernel |
| Patched CVEs | kcarectl --patch-info | grep CVE- | 6 CVE entries on our kernel |
| Remove all patches | kcarectl --unload | KernelCare protection disabled. Your kernel might not be safe |
| Release a key licence | kcarectl --unregister | On an IP trial: Error unregistering server: cannot find server id |
| Uninstall | dnf remove kernelcare | yum remove kernelcare on older systems |
Run kcarectl --help for the full list. Version 3.9 also has --status, --check, --smart-update, --auto-update and the userspace (--userspace-*) and library (--lib-*) patching options.
Install
curl -s -L https://kernelcare.com/installer | bash
# or download, read, then run:
curl -fsSL -o kernelcare_install.sh https://kernelcare.com/installer
less kernelcare_install.sh
bash kernelcare_install.shhttps://kernelcare.com/installer redirects to repo.cloudlinux.com/kernelcare/kernelcare_install.sh (installer v1.30 on our test day). An older address you may still see in guides, repo.cloudlinux.com/kernelcare/kc-install.sh, returned 404. The installer adds /etc/yum.repos.d/kernelcare.repo and the TuxCare signing key, installs the kernelcare package, and turns on automatic updates (AUTO_UPDATE=True in /etc/sysconfig/kcare/kcare.conf). Patches are then checked every four hours.
Licence: key, IP and the automatic trial
kcarectl --register YOUR_KEY # key-based licence
kcarectl --license-info # what the server is licensed forAn IP-based licence needs no registration: TuxCare’s activation guide says nothing else is required. Do not run kcarectl --register without a key; it only fails with error: argument --register: expected one argument.
With no licence at all, kcarectl --update on our lab printed Requesting trial license for IP ... Please wait... and got a 7-day trial for the server’s IP by itself.
A new licence can take a few minutes to work. Right after the trial was granted, --update kept failing with:
HTTP Error 401: Unauthorized: https://patches.kernelcare.com/patches/.../kpatch.binA few minutes later the same command applied the patches. TuxCare’s own explanation for a lasting 401 is an expired licence, or a server that was removed from CloudLinux Network (CLN). Check kcarectl --license-info, and re-register with your key if the licence is key-based.
To move a key licence to a new server, run kcarectl --unregister on the old one and kcarectl --register KEY on the new one. IP licences follow the IP, so change them in your CLN or provider account.
Apply and verify patches
kcarectl --update # Patch level 3 applied. Effective kernel version 5.14.0-687.54.1.el9_8 / Kernel is safe
kcarectl --info # kpatch-state: patch is applied
kcarectl --uname # 5.14.0-687.54.1.el9_8 (effective)
uname -r # 5.14.0-687.53.1.el9_8.x86_64 (booted, unchanged)
kcarectl --patch-info | grep -E '^kpatch-cve'The difference between kcarectl --uname and uname -r is the point of live patching. Security scanners that read uname -r will still report the old kernel, and KernelCare installs kcare-uname for tools that can use it. With patches loaded, lsmod lists the kcare module. To stop automatic patching, set AUTO_UPDATE=False in /etc/sysconfig/kcare/kcare.conf.
Unload patches and uninstall
kcarectl --unload # remove the live patches (protection off)
kcarectl --unregister # key licences only
dnf remove kernelcare # yum remove kernelcare on older systemsAfter --unload, kcarectl --info went back to No patches applied and the kcare module was gone. After dnf remove kernelcare, these were still on the server:
| Leftover | Size | Remove with |
|---|---|---|
/etc/sysconfig/kcare (config and blacklists) | 12 KB | rm -rf /etc/sysconfig/kcare |
/usr/libexec/kcare | 320 KB | rm -rf /usr/libexec/kcare |
/var/log/kcarectl.log | 24 KB | rm -f /var/log/kcarectl.log |
/etc/yum.repos.d/kernelcare.repo | Repository | rm -f /etc/yum.repos.d/kernelcare.repo |
rpm key gpg-pubkey-80935b88 (KernelCare Packages) | Signing key | rpm -e gpg-pubkey-80935b88 |
With those removed, our lab’s package count was back to exactly what it was before the install. Removing KernelCare does not change the booted kernel: reboot into an updated kernel from your normal package updates to stay protected.
Common problems
- HTTP Error 401: Unauthorized on --update. Right after a new licence, wait a few minutes and retry. If it persists, check
--license-infoand re-register the key. - “argument --register: expected one argument”. You ran
--registerwithout a key. IP licences do not need it. - The vulnerability scanner still reports the old kernel. Scanners read
uname -r. Show themkcarectl --unameorkcare-uname, or reboot into the new kernel. - The installer URL gives 404. Use
https://kernelcare.com/installer; the oldkc-install.shaddress no longer works. - Folders are left after uninstalling.
dnf removeleaves the config, libexec folder, log, repo file and key; see the table above.
Frequently asked questions
How do I check that KernelCare is working?
Run kcarectl --info and look for kpatch-state: patch is applied, then kcarectl --uname, which shows the effective kernel version after patching. uname -r keeps showing the kernel you booted.
Do I need to run kcarectl --register for an IP-based licence?
No. TuxCare says nothing else is required for IP-based licences. kcarectl --register expects a key, and without one it fails with expected one argument.
Why does kcarectl --update return HTTP Error 401 Unauthorized?
The licence is not valid for the server yet or any more. On our lab a newly granted trial gave 401 for a few minutes and then worked. If it lasts, check kcarectl --license-info and re-register your key.
How do I uninstall KernelCare?
Run kcarectl --unload to remove the live patches, kcarectl --unregister for a key licence, then dnf remove kernelcare. Afterwards delete /etc/sysconfig/kcare, /usr/libexec/kcare, /var/log/kcarectl.log and /etc/yum.repos.d/kernelcare.repo.
Does KernelCare give a free trial?
On our lab, running kcarectl --update with no licence requested a 7-day trial for the server’s IP automatically. TuxCare also offers trials through its website.
Reading a lot of our guides? Go ad-free with srvScripts Pro for $6 a month. It also pays for new guides. Cancel any time.