This is probably more of a compliance question, so if there is a better place to ask, please let me know.
It is a long complex story, but we can't easily update our linux kernels due to sub-optimal use of 3rd party software and configuration management systems. It has been suggested that I use KernelCare to patch 30k of our servers kernels.
We have sensitive confidential data, PCI systems and much more. We are audited on a regular basis by multiple external parties.
While I can find thousands of sites clammering over the use of this tool, I can not find any sites that reference operating system vendors, upstream linux kernel maintainers, security pen test organizations, or any other authoritative sources that could suggest this is recognized as a valid method of patching kernels and that it does not introduce additional risk. I also can not find any 3rd party validation of their tool that confirms it actually fixes all the vulnerabilities and does not introduce new vulns or back doors.
Aside from saying "no"; which I am perfectly capable of, has anyone gone through to exercise of validating this method of patching and specifically KernelCare? If so, what sources did you provide your customers and auditors?