Figure 3: SUSE's kGraft also lets you load individual kernel patches at run time, but the barriers to entry are much higher.