You can use Kpatch yourself ... and test the effects of live patching a kernel on your mission critical systems all by yourself before you deploy said live patch to sad systems that are so mission critical you're considering live patching in the first place ... OR ... you can have Canonical do all the testing of said kernel patch on EVERY VERSION OF UBUNTU on that kernel and rest easy that you now have you claim to have systems with both zero down time AND with no known vulnerabilities. Ok, here's a link to the instructions.

http://jensd.be/651/linux/linux-live-kernel-patching-with-kpatch-on-centos-7