How does it handle kernel updates? Can it do live patching?