CVE flood pushes Ubuntu onto weekly kernel release cycle

Canonical is speeding up Ubuntu kernel releases to one a week as AI-assisted bug hunting helps bury defenders under an ever-growing pile of CVEs.

The Ubuntu maker is overhauling how it ships kernel Stable Release Updates (SRUs), replacing its current four-week regular and two-week security cycles with overlapping two-week cycles that will push a kernel release every week.

Canonical says the change is needed because the number of reported vulnerabilities has exploded, with AI deserving some of the credit – or blame, depending on which side of the patch queue you're sitting.

"Large language models (LLMs) and specialized AI agents have transformed bug discovery from a manual, time-intensive process into a highly automated engine," Canonical said on Wednesday.

AI isn't solely responsible for the CVE avalanche.

The upstream Linux kernel community became a CVE Numbering Authority in 2024 and began assigning identifiers to thousands of bugs on the basis that almost any kernel flaw affecting a running system could have security implications.

Put the two together, and Linux vendors have far more CVEs to deal with.

Canonical says the resulting backlog requires faster releases to shrink the window between vulnerabilities becoming public and patched kernels reaching users.

Under the new system, each SRU cycle lasts two weeks, but a new one starts every week.

The first week is spent integrating patches, preparing and building kernel packages, and carrying out basic checks to make sure nothing catches fire.

By the end of that stage, release candidates are published to Ubuntu's -proposed pocket.

Week two is reserved for the heavier stuff, including hardware certification, distro integration, and regression testing.

Once that's done, the kernel is released.

Because the next cycle starts while that testing is under way, Canonical can publish another kernel the following week.