Linux will let you overwrite files "in use" (though the program(s) using them may not notice) and "file" is determined by a magic number, the inode - you can delete a file from a directory, really it's removing _that inode_, and put a new file in place with the same name, it's a _new_ inode. Programs that still have the file open are referring to the _old_ inode, which only goes away once everyone stops using it.
So actually you need to go round restarting your programs/services on Linux to get them to pick up changes (most package managers do that automatically), but at least it's _possible_ to make those changes without a reboot. Windows has to go into a special mode where nothing else runs, to be sure that it can update files.
Suse systems in general are just so much nicer to administer than RedHat or Debian/Ubuntu ones (imo of course).
So they moved to something more like the Windows style, where it downloads, reboots to apply and then reboots again freshly updated.
This what it said on the tin since forever for Linux systems, and it doesn't hurt.
Also, it surfaces long-running bugs so I can report them.
Note that just replacing files on disk is not sufficient because all the running software would still have the old version.
In the first place it means the security issue could still be present in currently running software, in the second place exciting things can happen when two (or more?!) different versions try to talk to each other. Oh, and who's to say the whole file was fully loaded into memory (or wasn't partially paged out) - imagine the fun that would happen if you later page in data from a different version of the binary!
So you need to hot patch the running binaries. I don't really remember why it's not done in practice even though it's technically possible, I seem to remember the conclusion was that clustering (in whatever form) was the solution for high availability, rather than trying to keep a single machine running.
Most systems are technically capable of hot patching (if your exe file is mmaped, and you change the backing file, Bob's your uncle, unless your OS is no fun; which is why unix install pattern is unlink and replace rather than in-place updares). But most executables are not built to be hot patched, especially not without coordination.
Hot patching lets you make changes to your live environment with tremendous speed, but it also has risk of changing your live environment to an offline environment with tremendous speed. I'm a proponent of hot patching, and would love to be able to hot load all the things, but it has requirements and tradeoffs and most software isn't built for it, and that's probably the right decision for most things.
It doesn't matter if it was paged out, virtual memory is still just memory.
Paging out & restoring some memory doesn't know or care where the contents originally came from. It doesn't have an optimization that goes "Oh this chunk of memory is an executable file. I can skip writing this out to the swap file, and later when I need to restore it I can just read the original file instead of swap."
For files that a program opens, an open handle is an open handle. The entire file is available in whatever state it was at the time the handle was opened, modulo whatever changes this specific handle has made.
If a program closes and re-opens handles, then it always knew that the entire world could have changed between those 2 opens. Same if it opens non-exclusive. If it opens without exclusive or closes & reopens, then it's ok for the data to change between each access.
There are problems during updates, but they are much higher level and safer than that. Open file handles are open file handles, and currenly loaded exes are consistent and sane until they close. All the problems are in the higher level domains of processes interacting with each other.
But in fact it is true that the pages that are mapped to a file on disk will not be redundantly written to the page file. Some pages might if they were modified by relocation fixups.
More info: https://devblogs.microsoft.com/oldnewthing/20170119-00/?p=95...
That links to this which is also salient: https://learn.microsoft.com/en-us/archive/blogs/larryosterma...
And in case you're wondering how this plays with ASLR: https://devblogs.microsoft.com/oldnewthing/20160413-00/?p=93...
So if you want to overwrite a running service then you can either stop it, update it, and restart it (tricky to manage if it has dependencies, or is necessary for using the PC), or to shut down everything, update the files while the OS isn't (or is barely) running, and then restart the OS.
Linux does do this (try overwriting or truncating a binary executable while it's running and you'll get -ETXTBSY).
The difference is that Linux allows you to delete (unlink) a running executable. This will not free the on-disk space occupied by that executable (so anything you write to disk in the immediate future will not overwrite the executable, and it can continue executing even if not all of the executable has been paged in) until all references to its inode are freed (e.g. the program exits and there are no other hardlinks to it).
Then you can install a new version of the executable with the same name (since a file by that name no longer exists). This is what install(1) does.
I semi-regularly have to reboot my Linux system despite the kernel remaining unchanged.