Artificial intelligence is getting very good at finding software bugs. That sounds like a win for security, but it is also creating a new problem: somebody still has to fix everything AI discovers.
Canonical says the rapidly growing number of Linux vulnerabilities is now forcing it to change how Ubuntu kernel security updates are delivered. The company is moving away from its existing four-week regular and two-week security Stable Release Update cycles in favor of a unified two-week process that will result in new kernel releases every week.
The reasoning is particularly interesting. Canonical directly points to artificial intelligence as one of the forces behind the explosion in reported CVEs. Large language models and specialized AI agents can automate work that previously required much more manual effort, allowing researchers to uncover bugs at a much faster rate.
There is another factor too. The CVE Program officially added kernel.org as a CVE Numbering Authority in 2024, giving the Linux kernel team the ability to assign CVE identifiers for vulnerabilities within its scope. The kernel’s own documentation says potentially security-related fixes can now receive CVEs as part of the normal stable release process.
That helps explain why the numbers can look alarming. The Linux kernel team says it takes a deliberately cautious approach because almost any kernel bug could potentially have security implications. It also warns that many assigned CVEs may not actually apply to a particular Linux system because users only run a subset of the enormous kernel codebase.
In other words, Linux did not suddenly become wildly insecure overnight. We are getting much better at finding and cataloging problems that may have previously gone unnoticed. AI is accelerating that process, while the kernel’s newer CVE assignment approach is making more of those bugs visible to the security ecosystem.
Canonical’s answer is overlapping two-week kernel cycles. During the first week, engineers prepare kernel packages, select patches, build them, and perform basic smoke testing. The second week focuses on hardware certification, Ubuntu integration, and regression testing. Because a new cycle begins every week, finished kernels can also arrive weekly.
That testing component matters because simply pushing patches faster would be easy. Doing it without introducing regressions across the enormous variety of hardware running Ubuntu is the harder part. Canonical says it intends to retain its extensive certification and regression testing rather than trading reliability for speed.
Organizations that cannot wait for the full cycle will have another option. Kernel release candidates are published through Ubuntu’s -proposed pocket before certification testing, and Canonical says those builds will be updated weekly. Companies willing to perform their own acceptance testing can therefore potentially get access to fixes sooner.
That is not something ordinary Ubuntu users should rush to enable. The point of -proposed is that those packages have not yet completed Canonical’s full certification and regression process. For organizations facing a serious vulnerability, however, having the option to test a fix early could be valuable.
Canonical is also addressing the awkward period between a vulnerability becoming public and a patched kernel reaching users. The company says it will try to provide safe workarounds or hardening guidance when possible, with a target of helping customers reach a safer state within 24 to 48 hours of public disclosure.
There is something almost ironic about all of this. AI is routinely pitched as a tool that will make software development faster, but it is also making vulnerability discovery faster. That means maintainers now have to accelerate the other side of the equation too.
For Ubuntu users, that should ultimately be good news. More bugs being discovered is preferable to vulnerabilities sitting unnoticed in the Linux kernel. The challenge for Canonical is making sure the growing torrent of CVEs can be fixed quickly without turning faster security updates into a source of new problems.
Support independent tech journalism
NERDS.xyz is independently owned and operated. If you enjoy my coverage of Linux, AI, hardware, cybersecurity, and tech culture, consider supporting the site on Ko-fi.
Support NERDS.xyz
