UBUNTU IS TIGHTENING ITS KERNEL SRU CYCLE TO TWO WEEKS, AND CLANKERS ARE TO BLAME

**Hacker Pranks Exclusive: Ubuntu's Kernel SRU Cycle Shrinks to 2 Weeks Amid Rising AI-Driven Vulnerability Hunting**

The world of cybersecurity is constantly evolving, with hackers and researchers alike pushing the boundaries of innovation and vulnerability discovery. In a recent move, Canonical, the company behind Ubuntu, has decided to tighten its kernel Stable Release Update (SRU) cycle to just two weeks. This change is a direct response to the growing threat of AI-driven vulnerability hunting, which has become increasingly prevalent in recent months.

**The Old SRU Cycle: A 4-Week and 2-Week Split**

Until now, Canonical had followed a split kernel SRU cycle, where regular fixes and security patches lived on separate tracks. This meant that a full update was released every four weeks, with a security-focused release at the two-week midpoint for urgent CVE fixes. This system was designed to provide a balance between stability and security, but it's clear that it's no longer sufficient in today's fast-paced cybersecurity landscape.

**The New 2-Week Cycle: Faster Patch Deployment and Certification**

Canonical is now replacing both tracks with a single 2-week cycle, which will result in a kernel release landing every week. The new cycle starts with a week of patch integration and prep work, where the kernel team selects which fixes land on each kernel, builds the packages, and runs basic smoke tests. The builds are then pushed into Ubuntu's -proposed pocket, where kernel release candidates live before they have been certified.

In the second week, Canonical runs the builds through its Ubuntu Certified hardware testing program, putting them through different machine types to ensure that nothing breaks in the real world before the kernel ships. This new cycle is designed to provide a faster response to emerging vulnerabilities, with the goal of having a workaround published within 24 to 48 hours of a CVE going public.

**The Rise of AI-Driven Vulnerability Hunting: A Growing Concern**

So, what prompted this change? According to Canonical, the decision was driven by the increasing use of Large Language Models (LLMs) and AI agents in vulnerability hunting. These automated tools have made it possible to find kernel bugs at a scale and speed that no individual human researcher could replicate. In fact, just last month, we saw how these agents were "bleeding compute resources" from git.kernel.org simply by scraping it for training data.

**Conclusion: A Faster, More Agile Approach to Kernel Security**

The new 2-week SRU cycle is a bold move by Canonical to stay ahead of the game in the world of cybersecurity. By shortening the window between a CVE going public and a patch landing, Ubuntu is responding to a rapidly-evolving situation and providing a safer, more secure experience for its users. This change is a testament to the company's commitment to staying at the forefront of kernel security and its willingness to adapt to the ever-changing landscape of vulnerability hunting.

As we continue to navigate the complex world of cybersecurity, it's clear that Ubuntu's decision to tighten its kernel SRU cycle is a step in the right direction. With the rise of AI-driven vulnerability hunting, it's more important than ever to have a fast, agile approach to kernel security. By working together, we can stay one step ahead of the hackers and keep our systems safe from emerging threats.