this exact scenario is why more teams are bypassing OS-level kernel patching entirely for workload