ESXi Live Patch: Patching ESXi Without a Reboot (8.0 U3, 9.0, 9.1) and Which Updates Qualify

Short answer: Yes, you can patch ESXi without a reboot, but only for releases that Broadcom marks as Live Patchable. You also need vCenter and every host on 8.0 Update 3 or later and a cluster managed by a vSphere Lifecycle Manager (vLCM) image, with Live Patch turned on in remediation settings. Most ESXi updates still need a reboot. Check the Live Patchable field in each release note before you plan a no-downtime window.

What ESXi Live Patch does

Live Patch arrived in vSphere 8.0 Update 3. At first it covered VMX-related security fixes, meaning the process that runs each virtual machine. Qualified hosts stay out of maintenance mode, don’t reboot, and don’t need to migrate VMs (ESXi 8.0 U3 release notes). Running VMs switch to the patched VMX through Fast Suspend and Resume (FSR). VCF 9.0 added user-space live patching and live patching of NSX transport nodes, because the NSX kernel modules now ship with ESX (What’s New in vSphere 9.0).

Which ESXi updates are live-patchable

A release is live-patchable only when its release notes say so. The table lists what the Broadcom release notes state as of September 2026:

There’s a pattern. Small, security-only patch releases can be live-patchable. Update and bugfix releases that change drivers or the kernel are not. On the 9.x release notes the build details for live-patchable releases also show Host Reboot Required: No and Virtual Machine Migration or Shutdown Required: No. Sources: ESX 9.0.0.0100, ESX 9.1.0.0100, ESXi 8.0 U3k.

Requirements

• vCenter and all ESXi hosts in the cluster on 8.0 Update 3 or later. ESXi 7.0 U3 is not supported.
• The cluster is managed with a single vLCM image. Baselines don’t work.
• vSphere DRS is enabled, and the parallel remediation setting is turned off.
• The host is eligible for that specific live patch according to the vLCM image depot.
• No DPUs (vSphere Distributed Services Engine). Hosts with TPM devices are not compatible on 8.0 U3; Broadcom lists them as compatible starting with vSphere 9.1.

These come from Broadcom KB 419942 and the TechDocs page Configuring vSphere Lifecycle Manager for Live Patches.

VMs that still need attention

VMs that can’t use FSR have to be migrated or power-cycled before they pick up the patched VMX. These VMs raise compliance warnings but don’t block remediation:

• Fault Tolerance VMs
• DirectPath I/O (passthrough) VMs
• vSphere Pods
• Shared-disk clusters, for example SQL Server failover cluster instances

How to apply a live patch

1. Import the live-patchable release into the vLCM depot and update the cluster image to it.
2. In the cluster’s vLCM remediation settings, enable Live Patch and turn off parallel remediation.
3. Run the remediation pre-check. It lists the hosts that qualify for a live patch.
4. Remediate. Qualified hosts are patched in place. Hosts that fail a prerequisite fall back to the usual maintenance mode and reboot, even with the Live Patch setting on (KB 452778).

On vSAN compute clusters, ESX 9.1.0.0100 has a known issue where the live patch pre-check fails with The health check failed to complete. Read the known issues in the release notes before you start.

Related on vDan

• ESXCLI commands for ESXi 8.0
• vSphere 9.0 product line comparison

Further reading

• Vladan Seget: Patching ESXi Without Reboot – ESXi Live Patch – Yes, since ESXi 8.0 U3 (the original post)
• Broadcom TechDocs: Configuring vSphere Lifecycle Manager for Live Patches
• Broadcom KB 419942: Prerequisites for enabling vLCM Live Patching
• Broadcom KB 316595: Build numbers and versions of VMware ESXi/ESX