CVE flood pushes Ubuntu onto weekly kernel release cycle
Canonical will ship Ubuntu kernel updates weekly after AI-assisted hunting and kernel CVEs outpaced its patch cycle.
Canonical is replacing Ubuntu's four-week regular and two-week security kernel SRU cycles with overlapping two-week cycles that publish a kernel every week. It cites a surge in CVEs, partly from LLM and AI-agent bug hunting and from the Linux kernel community becoming a CVE Numbering Authority in 2024. Week one integrates patches and publishes candidates to the -proposed pocket; week two covers certification and regression testing. Canonical also aims to offer workarounds or hardening guidance within 24 to 48 hours of public disclosure.
- Ubuntu kernel SRUs move to overlapping two-week cycles with a weekly release
- AI bug hunting and the kernel CNA role increased CVE volume
- Candidates reach the -proposed pocket after week one, before full certification
- Workarounds or hardening are targeted within 24 to 48 hours of disclosure
- Vendors
- Canonical
- Products
- UbuntuLinux kernel
- Organizations
- Canonical
From the original article
2 min read at theregister.comAI-assisted bug hunting is helping pile up vulnerabilities faster than defenders can patch them, so Canonical is picking up the pace
By Carly Page · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.