There are a lot of live patching solutions available, paid and free. On my Debian systems, I use KernelCare (like $2.50/server/mo) for a hands-off experience, have only had good experiences over the years.

It's possible that you can do it yourself on Debian (maybe look into https://packages.debian.org/stable/kernel/kpatch), but it was a bit labor intensive, last time I checked, as you have to manually select patches to apply.