Ubuntu 22.04 LTS Jammy Jellyfish: What Shipped and What Changed

Ubuntu 22.04 LTS "Jammy Jellyfish" was released on 21 April 2022 with the Linux 5.15 kernel and GNOME 42, and its standard security maintenance runs to May 2027 on Canonical's release cycle page (the release notes say April 2027), with Expanded Security Maintenance to May 2032 and the Legacy add-on to May 2037 through Ubuntu Pro.

It was the release that moved Ubuntu to OpenSSL 3.0, made Wayland the default session on most hardware, shipped Firefox only as a snap, disabled ssh-rsa in OpenSSH by default and made the nftables firewall backend the norm for an LTS. This post lists the facts of the release with a citation for each, walks through what changed since 20.04 LTS "Focal Fossa" and the three interim releases in between, and explains the security defaults. For end of life planning, read our companion posts on Ubuntu 22.04 end of life dates and 22.04 container base images; this one is about what actually shipped.

Key takeaways

• Released 21 April 2022, codename Jammy Jellyfish, per the published release schedule. The release team's announcement on Ubuntu Discourse is timestamped 22 April 2022.
• Kernel 5.15. Ubuntu Server defaults to the 5.15 GA kernel. Ubuntu Desktop tracks a rolling HWE kernel, which started at 5.15 and reached 6.8 with 22.04.5. The newest certified laptops got a 5.17 OEM kernel.
• GNOME 42, with some apps held at their GNOME 41 versions. Wayland is the default session unless the machine has an NVIDIA graphics card.
• OpenSSL 3.0. Certificates signed with SHA-1 or MD5 are invalid at the default security level, TLS below 1.2 stays disabled, and anything linked against libssl1.1 has to be rebuilt.
• OpenSSH disables ssh-rsa by default. Check this before you upgrade a remote machine over SSH.
• Firefox is only a snap, maintained by Mozilla and sandboxed.
• Support: standard security maintenance to May 2027 (release cycle page) or April 2027 (release notes), ESM to May 2032, Legacy add-on to May 2037. Flavours other than Desktop, Server, Cloud and Core got 3 years.
• Ubuntu Pro arrived during the 22.04 cycle: public beta on 5 October 2022, general availability on 26 January 2023. It is free for personal use on up to 5 machines.
• Compliance: FIPS 140-3, DISA-STIG and CIS are all "Achieved" for 22.04 on the release cycle page as of 23 October 2026.
• ufw is installed and off by default. needrestart prompts on Ubuntu Server after upgrades, and APT holds back phased updates.

What are the Ubuntu 22.04 LTS release facts?

The announcement names seven flavours released the same day: Ubuntu Budgie, Kubuntu, Lubuntu, Ubuntu Kylin, Ubuntu MATE, Ubuntu Studio and Xubuntu. Each flavour published its own release notes, and the 22.04 notes link to them.

What happened when: the 22.04 timeline

The point release rows show the schedule date and the security notice cut-off printed in each change summary; the notes do not print the day each point release was announced. One date clearly moved: the 22.04.1 notes include security notices up to 9 August 2022, later than the 4 August date the original announcement gave for 22.04.1.

How long is Ubuntu 22.04 LTS supported?

Short version: standard security maintenance to May 2027, ESM to May 2032 with Ubuntu Pro, and the Legacy add-on to May 2037. Our 22.04 end of life post covers what each phase means and the options as the date approaches, and the container base image post covers ubuntu:22.04 images specifically.

Two details matter. First, the official sources disagree by a month: the release cycle page says May 2027, while the 22.04 release notes say maintenance updates run "for 5 years until April 2027." We use the release cycle page because the ESM page and the kernel lifecycle page give the same May dates. Second, the five year promise covers Ubuntu Desktop, Server, Cloud and Core. The other flavours were supported for three years from release, so a Kubuntu or Xubuntu 22.04 install has been outside its flavour's support window since 2025, even though many of its packages are shared with Ubuntu and keep getting fixes.

The kernel lifecycle page gives the 5.15 and 6.8 kernels the same end dates as the release.

What kernel does Ubuntu 22.04 LTS use?

Canonical shipped more than one kernel with 22.04, and which one you got depended on the product, according to the 22.04 release notes:

• Ubuntu Server defaults to a non-rolling LTS kernel, 5.15 (linux-generic).
• Ubuntu Desktop uses a rolling HWE kernel (linux-hwe-22.04) on most hardware, based on 5.15 for the 22.04.0 and 22.04.1 point releases.
• The latest certified devices opt in automatically to a 5.17 kernel (linux-oem-22.04).
• Cloud and devices use optimised kernels built with partners, 5.15 or later with backports.

The kernel lifecycle page says the same thing in operational terms: desktop installs of 22.04 default to tracking the HWE stack, server installs default to the GA kernel with the enablement kernel optional, and the 22.04 HWE stack follows the rolling update model. Some desktops sit on a separate OEM track, which ubuntu-drivers list-oem reveals.

The rolling HWE stack moved through several newer kernels during the cycle. The point release change summaries show the work: 22.04.2 enabled the HWE kernel variant on the install media, 22.04.4 added the 6.5 kernel's AppArmor features to the image build ("This will roll as HWE"), and 22.04.5 added preseeds for the 6.8 kernel's AppArmor features. Today the lifecycle page lists only two kernels for 22.04 as supported: 5.15 GA and 6.8 HWE. The intermediate HWE kernels are no longer on that page, so we do not list their versions here.

One kernel default matters for operators: since 20.10 the kernel disables UDP as a transport for NFS mounts, so an NFS mount that asks for UDP fails.

What desktop does Ubuntu 22.04 LTS ship?

The release announcement leads with GNOME 42 and power profiles. The release notes add features from GNOME 41 and 42, several apps held at their 41 versions "by mostly avoiding libadwaita", ten accent colours and the cross-desktop dark style. systemd-oomd ships by default on Ubuntu Desktop.

Wayland by default, and why it matters for security

The default session on most systems without an NVIDIA graphics card is Wayland. If you need X.org, the "Ubuntu on Xorg" session is still on the login screen. The 21.04 notes first made Wayland the default on most configurations and described it as featuring "better security and performance." The official notes do not spell out the security mechanism, so we will not either; the practical takeaway is to keep Wayland unless a specific application needs X.org, and to test screen sharing and remote support tools before a fleet upgrade. Remote desktop changed at the same time. 22.04 adds RDP for desktop sharing, and the notes say legacy VNC is still there but RDP is "strongly recommended" for security, privacy and performance. If you used VNC sharing on 20.04, you have to re-enable desktop sharing in Settings after the upgrade.

Firefox only as a snap

From 22.04, Firefox is provided in Ubuntu only as a snap. The notes list the reasons Canonical gave: maintained directly by Mozilla, easier to keep current across the LTS, channel switching between ESR, stable, beta and edge, and "sandboxed for improved security hardening for this critical app." The 21.10 notes record the first step, when Firefox 93 was seeded as a snap by default instead of a deb.

The change had known costs at release. The snap did not yet support the NativeMessaging protocol, and the notes told people who need PKCS#11 smartcard support in Firefox not to upgrade until it was added to the snap. 22.04.1 brought a "significantly faster" startup. For a deeper comparison of the snap and other sandbox packaging models, see our post on Snap Store and Flatpak security models.

What changed from Ubuntu 20.04 LTS to 22.04 LTS?

The 22.04 notes say plainly that an upgrade from 20.04 brings everything from the three interim releases, 20.10, 21.04 and 21.10, plus the changes since 21.10. This table compares the two LTS releases on the points that matter for security and operations.

Server packages moved too: the notes list OpenLDAP 2.5.11 (BDB, HDB and shell backends removed), BIND 9.18.1, Apache 2.4.52, PostgreSQL 14.2, MySQL 8.0.28, Samba 4.15.5, QEMU 6.2, libvirt 8.0, containerd 1.5.9, runc 1.1.0 and LXD 5.0 LTS.

What came in through the interim releases

Most of the defaults that look new to a 20.04 user arrived in an interim release first. The table uses each interim's own release notes.

We cover each interim in depth in Ubuntu interim releases 18.10 to 23.10.

OpenSSL 3.0, SHA-1 and old TLS: what breaks and why

This is the change most likely to break something after an upgrade, so it gets its own section. The 22.04 release notes say the OpenSSL library moved to 3.0, "which disables a lot of legacy algorithms by default." Three things follow.

Certificates signed with SHA-1 or MD5 stop validating. The notes say these certificates "are now invalid under the default security level." An internal service, an old appliance or a private certificate authority that still issues SHA-1 signed certificates will fail TLS handshakes from a 22.04 client.

TLS 1.0 and 1.1 stay off. The notes point out that since 20.04, the default security level 2 already disables TLS and DTLS versions below 1.2. The Ubuntu Security documentation on legacy TLS lists the same defaults across libraries: OpenSSL at security level 2 with TLS 1.0 and 1.1 disabled, and SHA-1 signatures, RSA keys under 2048 bits and DH keys under 2048 bits disabled. GnuTLS and NSS enforce a TLS 1.2 minimum too.

Binaries built against OpenSSL 1.1 need a rebuild. OpenSSL 3.0 is an API bump, and the notes say "third-party packages that depend on libssl1.1 will need to be rebuilt to instead depend on libssl3, as the older ABI isn't provided anymore." Vendor debs, internal packages and copied binaries are the usual victims.

The fix in each case is to move the other side forward: reissue certificates with SHA-256, enable TLS 1.2 or 1.3 on the old server, and rebuild software against libssl3. The legacy TLS page documents a way to lower the security level, but marks it "not recommended" and frames it as a temporary measure for critical legacy compatibility; we do not reproduce it here. That page gives two commands for checking which protocol a remote server will negotiate:

openssl s_client -tls1_2 -connect example.com:443
openssl s_client -tls1_3 -connect example.com:443

OpenSSH: ssh-rsa disabled, and a safer scp

The security improvements section of the notes lists two OpenSSH changes. ssh-rsa is "now disabled by default," and the notes warn that anyone upgrading a system remotely over SSH "should check that you are not relying on this to ensure that you will retain access after the upgrade." Launchpad bug 1961833, linked from the notes, explains how to re-enable it selectively for a host that cannot be updated. And scp gained an SFTP mode the notes call "new, safer, behaviour."

Ubuntu Pro and the pro client during the 22.04 cycle

Ubuntu Pro did not exist on release day. The Ubuntu Pro FAQ on Discourse says Ubuntu Pro "was launched in public beta on 5 October, 2022, and moved to general availability on 26 January, 2023." So the free personal subscription arrived about six months into the 22.04 cycle, not with 22.04 itself.

What shipped with 22.04 was ubuntu-advantage-tools version 27.8, the client then invoked as ua. The 22.04 release notes list what it added: Pro and Pro FIPS images on the major public clouds, CIS benchmarks packaged in the Ubuntu Security Guide (USG), a beta real-time kernel based on 5.15, and a security-status view of updates from standard Ubuntu and ESM. The Pro beta tutorial from October 2022 required client version 27.11.2 or newer and listed 22.04 among the supported LTS releases. By 22.04.5, update-manager depended on ubuntu-advantage-tools 30 or newer and had switched from parsing ua security-status output to the Ubuntu Pro API, according to the 22.04.5 changes.

What Pro adds, in Canonical's words:

• ESM for the whole archive. The Ubuntu Pro page says ESM provides "10 years of vulnerability fixes for critical, high and selected medium vulnerabilities across the whole Ubuntu archive," extendable to 15 years with the Legacy add-on.
• Two streams. The ESM page splits it into esm-apps, which covers Universe packages for ten years from release, and esm-infra, which covers Main packages after their five years of standard maintenance end.
• Universe USNs. With the GA release, the FAQ says Canonical "started publishing Ubuntu Security Notices (USNs) for packages in the 'Universe' repository."
• Livepatch for high and critical kernel vulnerabilities without a reboot; see our post on what kernel Livepatch fixes and what still needs a reboot.
• Free for personal use. The Pro page says Pro "is and always will be free for personal use on up to 5 physical machines, or 50 machines for official Ubuntu Community members." The FAQ adds unlimited VMs and containers on top of those machines.

One detail has changed since the FAQ was written: it describes "2 year legacy extensions," while the current Pro and release cycle pages describe a Legacy add-on that takes 22.04 to May 2037, 15 years from release. We use the current pages. Our post on whether Ubuntu patches Universe packages explains the Main and Universe split in more depth.

Phased updates and needrestart on 22.04 servers

Two update behaviours surprise people who move a fleet from 20.04 to 22.04. Both arrived in 21.04.

Phased updates in APT

The Discourse post announcing phased updates in APT explains that APT 2.1.16 implemented phasing, which until then only update-manager did, and only on desktops. Now it works "on servers, raspberry pis, and containers, too." Some updates are held back on some machines while they are being phased, decided by a value derived from the machine ID, the package name and the version. The post documents options to make machines phase the same way or to always include phased updates, and notes that phasing does not apply to fresh installs.

So two identical 22.04 servers can show different apt upgrade results on the same day, by design. Our post on phased updates and whether security updates are delayed covers how security pockets fit in. Phasing also matters for release upgrades, as the walkthrough below shows.

needrestart prompts after upgrades

The 22.04 release notes say needrestart "was first installed by default in Ubuntu 21.04 and continues to feature in Ubuntu 22.04 LTS," to make sure services restart when their dependencies receive security updates. The needrestart for servers post gives the reason with a concrete example: after a libssl1.1 security update, every process linked against it still has the vulnerable library loaded until it restarts.

On 22.04 the default is to prompt after package upgrades when restarts are needed. Setting DEBIAN_FRONTEND=noninteractive makes needrestart fall back to list only mode, and the notes say you then need to restart services yourself, for example by rebooting or running needrestart -ra. This is the behaviour that changed in the next LTS: the 24.04 release notes say needrestart was modified to restart affected services "systematically," including in unattended upgrades. On 22.04, automatic security updates can leave daemons running old library code until something restarts them.

What are the security defaults in Ubuntu 22.04 LTS?

AppArmor 3.0.4, without the user namespace restriction

22.04 ships AppArmor 3.0.4, per the version table in the Ubuntu Security documentation, up from 2.13.3 in 20.04. The 22.04 release notes do not announce new AppArmor defaults for the release. The restriction on unprivileged user namespaces, controlled by kernel.apparmor_restrict_unprivileged_userns, is described as new in the 24.04 release notes, so a stock 22.04 install does not have it in the same form. The later 22.04 point releases did add AppArmor feature preseeds for the 6.5 and 6.8 HWE kernels, including a policy:unconfined_restrictions feature for 6.5, but the official notes do not describe a 22.04 default policy change. If you want the 24.04 behaviour, move to 24.04. Our post on AppArmor complain or enforce mode covers day to day profile management.

Firewall: nftables backend, ufw off

The 22.04 notes list nftables as the default firewall backend under security improvements, and warn that all applications on a system must agree on whether they use the legacy xtables backend or nftables, adding that "Docker may not be ready for the new nftables backend." The Ubuntu Security documentation dates the nftables default to 20.10 and says ufw is "available in Ubuntu, but disabled by default." The Ubuntu Server firewall guide agrees that ufw "by default is initially disabled." Nothing filters inbound traffic on a fresh 22.04 install until you turn it on. Our ufw first steps post walks through a sensible baseline.

Secure Boot and shim

The Ubuntu Security documentation on UEFI Secure Boot says that since 18.04, Secure Boot verifies the bootloader, kernel and kernel modules, and that since 20.04 a Microsoft-signed shim and a Canonical-signed GRUB are provided in the main archive as shim-signed. 22.04 continues that chain. One known issue: during installation with Secure Boot on, a Broadcom wireless driver will not load "due to a failure to sign the driver." Our post on Secure Boot, trusted boot and measured boot explains how the pieces relate.

Disk encryption and TPM

The 22.04 release notes do not describe TPM-backed full disk encryption for the desktop installer, so we do not claim it for this release. What they do record is TPM support for virtual machines: swtpm and libtpms are supported, virt-manager enables a TPM by default with UEFI, and LXD 5.0 virtual machines get vTPM support. The 21.10 notes describe an improved recovery key feature at installation time, now "optional, stronger and editable." For the later TPM-backed encryption work, see our 24.04 LTS post and 26.04 LTS post.

Automatic security updates

The Ubuntu Server automatic updates guide says unattended-upgrades is installed by default and that right after installation, automatic installation of security updates is enabled, "including Expanded Security Maintenance (ESM) if that is available on the system." By default it runs once per day. On a stock 22.04 server, then, patches arrive daily, some are phased, and services may keep old libraries loaded until restarted. See our unattended-upgrades post for reboot settings.

Compiler hardening

The default compiler and linker flags page lists the hardening Ubuntu applies when building the archive: PIE, BIND_NOW, -fcf-protection, fortify source, -fstack-clash-protection, RELRO and the stack protector. It dates PIE on all architectures to 17.10. The 22.04 release notes do not announce a change to these defaults, so treat 22.04 as inheriting them with GCC 11.2.0 as the compiler.

Other security-relevant changes

• journald defaults to zstd compression with keyed hashes, so journal files written on 22.04 cannot be read by the journal tools on 18.04, 20.04 or Core 20.
• sudo and root defaults, and archive signing keys: the 22.04 release notes do not state a change, so we make no claim. Our post on Linux distribution package signing covers how APT verification works in general.

Which architectures and hardware does 22.04 support?

The release cycle page lists amd64, armhf, arm64, s390x, riscv64 and ppc64el-p9. The ppc64el change is a real break: the 22.04 notes say Ubuntu Server for IBM POWER is compiled for POWER9, so 22.04 "will not run, install or even boot on POWER8 systems anymore," and do-release-upgrade blocks POWER8 machines from upgrading. 22.04 is also the first release with official POWER10 support. On IBM Z the minimum stays at z13.

22.04 is also the first LTS of Ubuntu Desktop for Raspberry Pi, and RISC-V gets a live installer image.

Where do FIPS, DISA-STIG and CIS stand for 22.04?

The release cycle page lists all three as "Achieved" for 22.04 LTS as of 23 October 2026: FIPS 140-3, DISA-STIG and CIS. That puts 22.04 ahead of 24.04, where the same page shows FIPS 140-3 as "Pending," and of 20.04, where FIPS 140-2 is now "Expired." If a contract requires FIPS 140-3 on Ubuntu today, 22.04 is the release the page lists as achieved, which is one reason some regulated fleets stay on it while others move to 24.04.

How do you check and upgrade an Ubuntu 22.04 system?

These steps use only commands from Canonical's docs. The first five read state and change nothing.

Step 1: Confirm the release

The Ubuntu Desktop docs use this command to show the release:

lsb_release --description

The Description line names the installed release. The 22.04.1 changes include a base-files fix, "/etc/os-release: add missing LTS to VERSION," so a system that has not taken updates since 22.04.0 may report a VERSION without "LTS". Update before you trust that file in inventory scripts.

Step 2: Check the kernel and HWE status

uname -r prints the running kernel, and the NVIDIA driver docs use it the same way to match driver modules to it. The kernel lifecycle page gives the support check and the command to opt a 22.04 server into the HWE stack:

uname -r
hwe-support-status --verbose
sudo apt-get install --install-recommends linux-generic-hwe-22.04

A 5.15 version means the GA kernel; a 6.8 version means the HWE kernel. Both are supported to May 2027.

Step 3: Check Ubuntu Pro and security coverage

The Pro Client docs explain pro security-status, which counts installed packages by source and shows whether ESM is covering them. The status columns explainer covers pro status.

pro status
pro security-status
pro security-status --esm-apps

Pay attention to packages from third parties and packages no longer available for download. Ubuntu will not patch those for you, before or after May 2027.

Step 4: Check the firewall

From the Ubuntu Server firewall guide:

sudo ufw status verbose
sudo ufw enable

Allow the services you need, such as SSH on a remote server, before you enable it.

Step 5: Check automatic updates

From the automatic updates guide, a dry run shows what unattended-upgrades would install without changing anything:

sudo unattended-upgrade -v --dry-run

Its logs are under /var/log/unattended-upgrades. If needrestart ran in list only mode, the 22.04 notes give needrestart -ra as one way to restart services afterwards.

Step 6: Upgrade from 20.04 to 22.04

The Ubuntu Server upgrade guide says you can only upgrade from one LTS to the next, only after the first point release, and only from a fully updated system, phased updates included:

sudo apt update
sudo apt dist-upgrade -o APT::Get::Always-Include-Phased-Updates=true
sudo do-release-upgrade

Check whether /run/reboot-required exists and reboot first if it does. Before you start, check the release-specific blockers from the 22.04 notes: POWER8 hardware cannot upgrade; ssh-rsa only access will stop working; third-party software linked against libssl1.1 needs rebuilt packages; OpenLDAP installs using BDB or HDB backends may need manual migration; BIND configurations using the map zone format must be converted first; and users of grub-customizer could hit a late-stage upgrade failure, with a workaround in the linked bug.

Step 7: Upgrade from 22.04 to 24.04

The same rules apply in the next hop. The 24.04 release notes say 22.04 users "will also start being offered the automatic upgrade now that 24.04.1 LTS has been released." The release cycle page lists 24.04 LTS as the only upgrade path from 22.04, and the server guide says you cannot skip LTS releases, so a 22.04 machine heading for 26.04 has to go through 24.04 first. The server guide says the development release flag "is not recommended for production environments."

Who should stay on 22.04, and who should move?

Stay on 22.04 for now if you need FIPS 140-3 today (the release cycle page lists it as achieved for 22.04 and pending for 24.04), or if your workload depends on the 22.04 behaviour of needrestart, AppArmor user namespaces or the GNOME 42 desktop and you have not tested 24.04 yet. Standard support runs to May 2027, and ESM to May 2032 is available through Ubuntu Pro.

Plan to move to 24.04 if you are on a flavour (its three years ended in 2025), if you want the newer AppArmor user namespace restriction and automatic service restarts after security updates, or if you would rather do the work before 2027 than in a rush near the date. Our posts on adopting a new LTS and the 24.04 LTS release cover the trade-offs.

Common mistakes

• Assuming 22.04 shipped with Ubuntu Pro. Pro went into public beta in October 2022 and GA in January 2023. Release-day 22.04 had ubuntu-advantage-tools 27.8 and the ua command.
• Treating the support end as April 2027 or May 2027 interchangeably. The release notes say April, the release cycle, ESM and kernel pages say May. Plan to the earlier date if a contract depends on it.
• Forgetting flavours. Kubuntu, Xubuntu, Lubuntu, Ubuntu MATE, Ubuntu Budgie, Ubuntu Studio and Ubuntu Kylin 22.04 had three years of support, not five.
• Upgrading a remote box that relies on ssh-rsa. OpenSSH in 22.04 disables it by default, and the notes warn you may lose access.
• Keeping vendor binaries linked against libssl1.1. The old ABI is not provided on 22.04.
• Assuming automatic updates restarted your daemons. On 22.04, needrestart in non-interactive runs only lists what needs restarting.
• Assuming ufw is protecting you. It is installed and off.
• Trying to jump from 20.04 straight to 24.04, or from 22.04 straight to 26.04. LTS upgrades go one LTS at a time.

FAQ

When was Ubuntu 22.04 LTS released?

On 21 April 2022, the Final Release date on the Jammy Jellyfish release schedule. The release team's announcement on Ubuntu Discourse is timestamped 22 April 2022.

What kernel does Ubuntu 22.04 use?

Linux 5.15. Ubuntu Server defaults to the 5.15 GA kernel. Ubuntu Desktop tracks the rolling HWE kernel, which started at 5.15 and reached 6.8 with 22.04.5, and the newest certified laptops got a 5.17 OEM kernel at release.

Is Ubuntu 22.04 still supported?

Yes. Standard security maintenance runs to May 2027 on the release cycle page (April 2027 in the release notes), ESM to May 2032 and the Legacy add-on to May 2037. See our 22.04 end of life post.

Does Ubuntu 22.04 use OpenSSL 3?

Yes, OpenSSL 3.0 (3.0.2 at release, per the s390x section of the notes). Certificates signed with SHA-1 or MD5 are invalid at the default security level, and software built against libssl1.1 must be rebuilt.

Why can't I SSH into a server after upgrading to Ubuntu 22.04?

One documented cause is that ssh-rsa is disabled by default in OpenSSH on 22.04. The release notes link Launchpad bug 1961833, which explains how to re-enable it selectively for hosts you cannot update yet.

Is Firefox a snap on Ubuntu 22.04?

Yes. From 22.04 Firefox is only provided as a snap, maintained by Mozilla and sandboxed. At release the snap lacked NativeMessaging and PKCS#11 smartcard support.

Is Ubuntu 22.04 FIPS certified?

The release cycle page lists FIPS 140-3 as "Achieved" for 22.04 LTS, along with DISA-STIG and CIS, as of 23 October 2026. The 22.04 notes also mention Ubuntu Pro FIPS images on the major public clouds.

Does Ubuntu 22.04 have a firewall enabled by default?

No. ufw is installed but disabled by default. The kernel firewall backend is nftables.

Can I upgrade Ubuntu 22.04 directly to 26.04?

No. LTS upgrades go one release at a time, so 22.04 moves to 24.04 first, then to 26.04.

Fix it without waiting for upstream

On 22.04 the operating system packages are the part Canonical patches for you, through USNs during standard support and through ESM after it. The part it does not patch is what you build on top: the npm, PyPI, Maven, Go and Rust dependencies in your services, the vendor binaries still linked against an old OpenSSL, and the third-party packages that pro security-status counts as outside Ubuntu's coverage. Moving a container from ubuntu:20.04 to ubuntu:22.04 does nothing for a vulnerable library pinned in your lockfile.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

Safeguard scans repositories, container images and SBOM files and matches the components it finds against vulnerability databases, so an image built on ubuntu:22.04 shows which OS packages and versions it carries, OpenSSL included, next to your application dependencies:

safeguard scan --dir .
safeguard scan --image your-image:tag
safeguard scan --sbom sbom.json

Results are written as JSON under ./output, and the platform shows every project that contains a given component and version. Safeguard does not patch the host kernel or the Ubuntu archive for you; that stays with Canonical's updates, ESM and Livepatch.

In this Safeguard CLI session you install the CLI, run safeguard to open the interactive terminal and ask it to fix the lodash CVE in a repository. It reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, prints a summary and pushes nothing. The same flow applies when you rebuild a service on 22.04 or 24.04: fix the application dependencies first, then change the base image.

Click through it at your own pace, or open it full screen.

This demo sets up the Safeguard runner on your own machine, approves it with its device code, then scans from the terminal. A 22.04 build server is a natural host for it, so repositories and images are scanned locally rather than leaving your network. Our guide to how the local runner and offline mode work covers the details.

Click through it at your own pace, or open it full screen.

This is a real Android session: you send work from the phone to a computer running the CLI, then approve each command on the phone with Allow once, Allow for turn or Deny. If a dependency fix on a 22.04 build host is waiting while you are away from your desk, you can review and approve each step without handing the assistant blanket permission.

Click through it at your own pace, or open it full screen.

To try it yourself, download Safeguard from safeguard.sh/download and follow the CLI docs.

Quick check

Sources

• Ubuntu release notes: Ubuntu 22.04 LTS
• Ubuntu release notes: Changes in Ubuntu 22.04.1
• Ubuntu release notes: Changes in Ubuntu 22.04.2
• Ubuntu release notes: Changes in Ubuntu 22.04.3
• Ubuntu release notes: Changes in Ubuntu 22.04.4
• Ubuntu release notes: Changes in Ubuntu 22.04.5
• Ubuntu release notes: Ubuntu 20.04 LTS
• Ubuntu release notes: Ubuntu 20.10
• Ubuntu release notes: Ubuntu 21.04
• Ubuntu release notes: Ubuntu 21.10
• Ubuntu release notes: Ubuntu 24.04 LTS
• Ubuntu Discourse: Ubuntu 22.04 LTS (Jammy Jellyfish) released
• Ubuntu Discourse: Jammy Jellyfish release schedule
• Ubuntu Discourse: needrestart for servers
• Ubuntu Discourse: Phased updates in APT in 21.04
• Ubuntu Discourse: Ubuntu Pro beta tutorial
• Ubuntu Discourse: Ubuntu Pro FAQ
• Ubuntu: Release cycle
• Ubuntu: Kernel lifecycle and enablement stack
• Ubuntu: Ubuntu Pro
• Ubuntu: Expanded Security Maintenance
• Ubuntu Security documentation: AppArmor
• Ubuntu Security documentation: Firewall
• Ubuntu Security documentation: UEFI Secure Boot
• Ubuntu Security documentation: Default compiler and linker flags
• Ubuntu Security documentation: Legacy TLS
• Ubuntu Server documentation: Firewalls
• Ubuntu Server documentation: Automatic updates
• Ubuntu Server documentation: How to upgrade your Ubuntu release
• Ubuntu Desktop documentation: Switch between an LTS and interim release
• Ubuntu Desktop documentation: Install NVIDIA drivers
• Ubuntu Pro Client documentation: What does security-status do?
• Ubuntu Pro Client documentation: The pro status output explained

Related reading in this series: every Ubuntu release, codename, kernel and support date, Ubuntu 20.04 LTS Focal Fossa, Ubuntu Pro and ESM history and the Ubuntu support lifecycle explained.

Last reviewed: 23 October 2026.