Canonical shifts Ubuntu to weekly kernel releases due to CVE surge

Canonical is implementing a new weekly kernel release cycle for Ubuntu due to the increasing volume of Common Vulnerabilities and Exposures (CVEs) attributed in part to AI-assisted bug discovery. This shift replaces the previous four-week regular and two-week security cycles with overlapping two-week cycles, resulting in a more rapid release cadence aimed at keeping pace with security threats.

The new release process consists of two phases: the first week focuses on integrating patches and preparing kernel packages, while the second week is dedicated to thorough testing and certification. This change allows Canonical to publish new kernels every week, enhancing the speed at which vulnerabilities are addressed. Organizations that need faster access to patches can utilize the -proposed pocket to test release candidates sooner, but this comes with the caveat of needing their own acceptance testing.

By enabling quicker releases and potentially faster access to fixes, Canonical aims to mitigate the risks associated with the delay from vulnerability disclosure to patch deployment. The initiative also includes providing safer workarounds and general hardening measures in the interim, ensuring that systems can be put into a 'defensible, safer state' while waiting for official patches.

This shift highlights the dual-edged nature of AI in software development, where automated bug discovery increases the number of vulnerabilities needing attention, thereby straining patch management processes. The kernel team's adaptation to a busier schedule reflects the pressing need for software security in a landscape where vulnerabilities are emerging at an unprecedented rate.