Ubuntu kernel CVE fixes are moving to a weekly release schedule
Canonical will ship Ubuntu kernel updates weekly by overlapping two-week cycles, with uncertified -proposed builds for faster CVE fixes.
Canonical is merging Ubuntu's four-week Stable Release Update cycle and its two-week security cycle into overlapping two-week cycles, so a kernel build is published every week. After a cutoff, the first week covers kernel builds and smoke tests that land in the -proposed pocket, and the second week covers certification before the kernels are released. Admins who cannot wait may install those uncertified release candidates and own any regression risk. Where a safe workaround exists, Canonical still aims to publish it within 24 to 48 hours of public disclosure.
- Overlapping two-week cycles produce a weekly Ubuntu kernel release.
- Uncertified -proposed builds are the path to fixes within a week.
- Certification still runs; skipping it leaves regressions to the adopter.
- Safe workarounds are targeted within 24 to 48 hours of disclosure.
Full article396 words · extracted from helpnetsecurity.com · click to collapse
Ubuntu kernels will ship every week under a new release schedule from Canonical, which is merging its four-week cycle for regular Stable Release Updates (SRUs) and its two-week cycle for security fixes into a single two-week cycle. The cycles overlap, each starting a week after the one before, which is what produces a weekly release.
Admins who need a kernel CVE fix sooner than the full cycle allows now have a sanctioned way to get one within a week: pull release candidates from the -proposed pocket before Canonical has run certification testing on them. Anyone running an Ubuntu fleet should plan for weekly kernel releases and decide which machines, if any, can take uncertified builds.
Canonical aims to publish workarounds within 24 to 48 hours of a vulnerability’s public disclosure, where a safe one exists. Where none does, the company says it will point users to general hardening steps.
Two schedules become one
Fixes pile up continuously until a cutoff date, when the kernel tree is snapshotted. In the first week, Canonical builds the kernels and runs smoke tests to confirm they boot and run. Those builds then land in -proposed, the part of the Ubuntu archive that holds release candidates. The second week goes to certification, integration and regression testing on hardware in the Ubuntu Certified program, and the kernels are released at the end of it.
Canonical ties the change to the number of CVEs, the public identifiers assigned to known vulnerabilities. LLMs and AI agents have automated much of bug hunting. The upstream kernel community also became its own CVE Numbering Authority and has assigned identifiers to thousands of bugs, reasoning that nearly any kernel bug affecting a running system could be a vulnerability.
The fast lane is untested
Canonical is keeping full testing on every release. “Expedited releases aren’t possible while thoroughly testing every release candidate,” the company wrote.
Teams that cannot wait can start their own acceptance tests on the -proposed builds, which update weekly. Canonical presents this as the route to kernel CVE fixes within one week, meant for teams willing to skip its certification stage to get them sooner. The fastest kernel Canonical offers is the one it has not finished testing, so any regression it carries becomes the adopting team’s problem.
Get great free software: 20 open-source cybersecurity tools to keep your team ready for anything