CVE flood pushes Ubuntu onto weekly kernel release cycle

Canonical is accelerating Ubuntu kernel releases to one per week due to an overwhelming influx of CVEs, which AI-assisted bug hunting has contributed to. The company is transforming its kernel release process by overhauling the current four-week regular and two-week security cycles into overlapping two-week cycles, resulting in a weekly kernel release.

This change is necessary to keep up with the surge in reported vulnerabilities, with AI playing a significant role in this trend. Large language models and specialized AI agents have revolutionized bug discovery, transforming it from a manual, time-consuming process into an automated engine. While AI is not entirely responsible for the CVE surge, Linux vendors now face an abundance of vulnerabilities to address.

Canonical believes that faster releases are crucial to minimize the time between vulnerabilities being public and patched kernels reaching users. The new system consists of two weeks of integrating patches, preparing kernel packages, and conducting basic checks, followed by a week for hardware certification, distro integration, and regression testing.

Upon completion, the kernel is released, enabling Canonical to publish release candidates within the first week and fully release the kernel the following week. For those who prefer a faster approach, organizations can utilize release candidates from the -proposed pocket after the first week and perform their own acceptance tests.

Canonical provides safer workarounds and recommends hardening measures within 24 to 48 hours of public disclosure, aiming to leave customers less exposed between disclosure and patch availability. This results in a more extensive kernel release schedule, but it may be necessary as AI continues to expedite bug discovery, making patching more challenging.