Canonical is releasing Ubuntu kernel updates faster to counter AI bug hunting

The ever-increasing use of artificial intelligence is having positive and negative effects. While AI is helping to speed up the development of software, it is also being used to find security flaws which can then be exploited.

It is in response to this that Canonical has announced that it is accelerating the release of kernel updates for Ubuntu. The change means that security updates will now be released every two weeks.

Explaining why the use of AI has necessitated the need to speed up patching, Canonical says: “The recent explosion in the volume of CVEs is fueled by artificial intelligence: large language models (LLMs) and specialized AI agents have transformed bug discovery from a manual, time-intensive process into a highly automated engine. Additionally, the upstream kernel community became its own CVE Numbering Authority (CNA) and assigned CVE (Common Vulnerabilities and Exposures) identifiers to thousands of bugs, arguing that at the kernel level, almost any type of bug that can affect a running system, could potentially be classified as a vulnerability. As a result, the volume of CVEs has skyrocketed exponentially, creating a massive backlog of alerts and forcing defenders to drastically increase the speed of their fixes to close the window of risk”.

Canonical goes on to explain how the new update cycle will work:

To address the growing volume of CVEs and the demand for faster security fixes, we are transitioning to a unified, 2-week release cycle. These recurring 2 week cycles cascade: each cycle begins the week after the previous one starts. Because of this overlap, kernel releases will take place weekly. The first week will focus on Kernel packages preparation. This is where we select what updates and patches land on each kernel depending on specific needs. The second week on testing for Ubuntu certifications. Through our Ubuntu Certified program, we rigorously test these kernels on different hardware types to ensure the best Ubuntu experience.

Going into further details, the company provides the following breakdown:

Here is how the new cycle breaks down:

Patch integration, snapshot of the tree at the cutoff date, and initial CI sanity checks

A 1-week kernel preparation phase with builds and basic checks to confirm kernels boot and run with no obvious issues. By the end of this stage builds are published in -proposed

Extensive certification, distro integration, and regression testing. By the end of this stage all test artifacts are completed

While more security updates being released faster is certainly a good thing, it is hard to ignore the fact that AI will continue to get faster and better at finding security holes – so it may not be long before even this faster release cycle is not enough.

Sofia Wyciślik-Wilson is a queer, transgender journalist based in Poland. She has been writing about technology for more than two decades, and after years working for magazines, her writing moved online. She is fueled by literature, music, nature, and vegetables. She is currently training to be an LGBTQ+ affirmative psychotherapist. You can find her on Bluesky and Mastodon. If you like what you read, you can Buy her a Coffee!