Canonical is shifting its Ubuntu Linux kernel update schedule to a weekly release cycle. Previously, standard updates were issued every four weeks, while security patches were released every two weeks.
The decision follows a surge in vulnerability reports. In September 2026 alone, the Linux Kernel project recorded over 1,500 CVEs, with nearly half rated as high severity and approximately 200 classified as critical. This increase is partly attributed to the project becoming a CVE Numbering Authority in 2024.
The new workflow utilizes a two-week preparation cycle for each update. During the first week, developers integrate fixes and perform initial testing before moving the package to the proposed repository. The second week is dedicated to deep integration and regression testing.
By overlapping these cycles, Canonical will deliver stable updates every week. Additionally, the company plans to issue risk mitigation guidance within one to two days if a public vulnerability is disclosed before a formal patch is ready.
The rise of AI tools has accelerated both vulnerability discovery and the volume of low-quality automated reports. This trend previously led cURL developer Daniel Stenberg to terminate his vulnerability reward program due to an influx of questionable AI-generated submissions.
