Ubuntu speeds up kernel updates as AI uncovers more security holes
Attackers no longer get the first shot. Canonical has changed its playbook. The company behind Ubuntu is now pushing out kernel security patches every two weeks. This is a direct answer to the flood of bugs found by AI tools.
Canonical has replaced its previous four-week and two-week update tracks with a single unified two-week cycle, resulting in new kernel releases being delivered to users almost every week.
Canonical says the spike in CVEs comes straight from AI. Large language models and specialized agents have turned bug hunting into an automated process. The upstream kernel community now acts as its own CVE Numbering Authority. It assigns IDs to thousands of kernel bugs. The logic is simple. Any kernel bug could be a security risk. This has created a backlog. Defenders have to move faster.
The new plan is simple. Canonical now runs a single, two-week cycle for kernel updates. Each cycle overlaps with the next. That means new kernel releases show up almost every week. The first week is for prep. Teams pick updates and patches for each kernel. They build and run smoke tests to check for basic stability. At the end of week one, builds go to the -proposed repository.
The Register and Help Net Security have independently confirmed that Ubuntu has shifted to a weekly kernel update release cadence, driven by the surge in CVEs attributed to AI-driven bug discovery.
This fast pace is Canonical's answer to the AI-driven spike in bugs. The company hopes that quicker patches will shrink the window for attackers. But the truth is clear. AI keeps speeding up bug discovery. Defenders have to keep up or get left behind.
Canonical's move is a big step in the security fight. The two-week cycle is a push to keep Ubuntu users safe. Old patch schedules can't keep up with AI. But AI is only getting faster. Even this new pace may soon feel slow. For now, Canonical is raising the bar for open-source security. Others may have to follow.
The official Canonical announcement from September 23, 2026, updated September 24, explains the new cycle. The first week covers package prep, builds, and smoke tests. The second week is for certification and regression testing before the public release.
