Canonical is changing how it releases Ubuntu kernel updates, introducing a new strategy to get CVE fixes to users faster without cutting back on testing.
The company is replacing the current mix of four-week regular kernel SRU cycles and two-week security cycles with a unified two-week release process. Since those cycles overlap, Ubuntu will effectively receive a new kernel release every week.
Importantly, that does not mean Canonical is reducing the full kernel testing process to seven days. A new two-week cycle starts every week, allowing one kernel to be in its final testing stage while the next is already being prepared.
During the first week, Canonical integrates patches, prepares packages, performs builds, and runs initial smoke tests. Kernel candidates are then published to Ubuntu’s -proposed repository.
The second week is focused on certification, integration, and regression testing before the kernel is released to users.
The main reason for the change is the growing volume of Linux kernel CVEs. Canonical notes that automated vulnerability discovery, including AI-assisted tools, is uncovering more issues than before.
At the same time, the Linux kernel project becoming a CVE Numbering Authority has also significantly increased the number of vulnerabilities receiving CVE identifiers, including many bugs that previously might not have been classified that way.
For users and organizations needing fixes earlier, kernel candidates will remain available through the -proposed repository before full certification is complete. This lets administrators start their own testing about a week before the stable release.
On top of that, Canonical also aims to respond faster when a complete kernel fix is not ready. The company plans to provide mitigations or safe workarounds within 24 to 48 hours of a vulnerability being publicly disclosed whenever possible.
If no workaround is available, Canonical will instead publish hardening recommendations until a proper patch can be delivered.
For additional details,
see Canonical’s announcement.
linuxiac.com
Public Exploits Released for Four Linux Kernel Flaws That Enable Local Root
ZDI: The Apple Security Update Review for September 2026
Canonical releases Ubuntu Linux 24.04 LTS 'Noble Numbat'
BitLocker zero-day exposes Windows drives as PoC goes public