Canonical is changing how it releases Ubuntu kernel updates, introducing a new strategy to get CVE fixes to users faster without cutting back on testing.
The company is replacing the current mix of four-week regular kernel SRU cycles and two-week security cycles with a unified two-week release process. Since those cycles overlap, Ubuntu will effectively receive a new kernel release every week.
Importantly, that does not mean Canonical is reducing the full kernel testing process to seven days. A new two-week cycle starts every week, allowing one kernel to be in its final testing stage while the next is already being prepared.
During the first week, Canonical integrates patches, prepares packages, performs builds, and runs initial smoke tests. Kernel candidates are then published to Ubuntu’s -proposed repository.
The second week is focused on certification, integration, and regression testing before the kernel is released to users.
The main reason for the change is the growing volume of Linux kernel CVEs. Canonical notes that automated vulnerability discovery, including AI-assisted tools, is uncovering more issues than before.
At the same time, the Linux kernel project becoming a CVE Numbering Authority has also significantly increased the number of vulnerabilities receiving CVE identifiers, including many bugs that previously might not have been classified that way.
For users and organizations needing fixes earlier, kernel candidates will remain available through the -proposed repository before full certification is complete. This lets administrators start their own testing about a week before the stable release.
On top of that, Canonical also aims to respond faster when a complete kernel fix is not ready. The company plans to provide mitigations or safe workarounds within 24 to 48 hours of a vulnerability being publicly disclosed whenever possible.
If no workaround is available, Canonical will instead publish hardening recommendations until a proper patch can be delivered.
For additional details, see Canonical’s announcement.
makes sense ai is finding issues faster then they could keep up with. all the talk of slowing down ai growth by the big ai companies will not solve anything since current models are already finding more issues then we can handle but many projects and companies are adjusting for this and will continue to adjust since they will have no choice and people are smarter then most realize with finding ways to adjust. The real reason they want government to get involved is so they can concentrate power into fewer companies. There is a lot of unnecessary hype by big tech that they are using to distract people from the real issues that they are having with there build outs and profits and even tech sitting in warehouses waiting to be used that they have purchased. Never trust big tech they have people that only create messages that they hope will benefit them plus they want people to keep throwing money at them. The most dangerous thing to your security is still you making bad choices like clicking on untrustworthy links that you should not in emails or downloading malware ect and the real data on this topic proves this.