Ubuntu kernel CVE fixes are moving to a weekly release schedule

Ubuntu kernels will ship every week under a new release schedule from Canonical, which is merging its four-week cycle for regular Stable Release Updates (SRUs) and its two-week cycle for security fixes into a single two-week cycle. The cycles overlap, each starting a week after the one before, which is what produces a weekly release.

Admins who need a kernel CVE fix sooner than the full cycle allows now have a sanctioned way to get one within a week: pull release candidates from the -proposed pocket before Canonical has run certification testing on them. Anyone running an Ubuntu fleet should plan for weekly kernel releases and decide which machines, if any, can take uncertified builds.

Canonical aims to publish workarounds within 24 to 48 hours of a vulnerability’s public disclosure, where a safe one exists. Where none does, the company says it will point users to general hardening steps.

Two schedules become one

Fixes pile up continuously until a cutoff date, when the kernel tree is snapshotted. In the first week, Canonical builds the kernels and runs smoke tests to confirm they boot and run. Those builds then land in -proposed, the part of the Ubuntu archive that holds release candidates. The second week goes to certification, integration and regression testing on hardware in the Ubuntu Certified program, and the kernels are released at the end of it.

Canonical ties the change to the number of CVEs, the public identifiers assigned to known vulnerabilities. LLMs and AI agents have automated much of bug hunting . The upstream kernel community also became its own CVE Numbering Authority and has assigned identifiers to thousands of bugs, reasoning that nearly any kernel bug affecting a running system could be a vulnerability.

The fast lane is untested

Canonical is keeping full testing on every release. “Expedited releases aren’t possible while thoroughly testing every release candidate,” the company wrote .

Teams that cannot wait can start their own acceptance tests on the -proposed builds, which update weekly. Canonical presents this as the route to kernel CVE fixes within one week, meant for teams willing to skip its certification stage to get them sooner. The fastest kernel Canonical offers is the one it has not finished testing, so any regression it carries becomes the adopting team’s problem.

Get great free software: 20 open-source cybersecurity tools to keep your team ready for anything

Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances

Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes

Researchers uncover malware that uses AI to choose its move

Download: The High-Performance Team Playbook

Simplify security management with CIS SecureSuite Platform

Download: The IT and security field guide to AI adoption

DarkMe RAT trades zero-days for plain phishing emails

Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances

Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes

Prismor: Open-source runtime control plane for AI agents

Product showcase: Scamwise checks the red flags before you take the bait