Canonical has introduced a new virtualization Hardware Enablement stack for Ubuntu 26.04 LTS, allowing users to access newer virtualization components while remaining on the long-term support release.
For reference, Ubuntu has long provided HWE kernels to support newer hardware. The new model, however, broadens this approach to userspace components required for modern virtualization. The stack includes qemu-hwe, libvirt-hwe, edk2-hwe (including OVMF firmware), and seabios-hwe.
Ubuntu 26.04 LTS already offers integrated host and guest support for AMD SEV-SNP and Intel TDX, which boost data protection during processing in virtual machines. However, additional confidential computing features are still under development in several upstream projects.
Canonical handles this with a rolling enablement window during the Ubuntu 26.04 LTS lifecycle. For the first two years after release, the virtualization HWE stack will be updated every six months with supported newer versions.
In practice, virtualization packages can follow Ubuntu’s interim release schedule, while the rest of the system remains on the stable LTS base. Canonical states that new components will first be tested in interim releases before being made available through the HWE stack.
Importantly, the new stack is optional. Existing Ubuntu installations will use standard virtualization packages unless an administrator chooses the HWE variants.
Moreover, Canonical provides the ubuntu_virt_helper tool to help administrators manage the virtualization stack as a complete unit. This prevents users from replacing only one component and creating incomplete or inconsistent combinations of QEMU, libvirt, and firmware packages.
The virtualization HWE stack is designed for organizations running confidential VMs with AMD SEV-SNP or Intel TDX, regulated workloads needing stronger isolation, confidential AI inference, private and sovereign cloud platforms, and infrastructure requiring long-term maintenance with support for evolving hardware.
For these environments, the new model eliminates the need to choose between moving virtualization hosts to a short-lived interim release or waiting for the next LTS release to access new capabilities.
For additional details, see Canonical’s announcement.
