Ubuntu 24.04 LTS Noble Numbat: Release Facts, Kernel 6.8, Security

Ubuntu 24.04 LTS "Noble Numbat" was released on 25 April 2024 with Linux kernel 6.8 and GNOME 46, and it is security maintained until 31 May 2029, with Expanded Security Maintenance to May 2034 and the Legacy add-on to May 2039 through Ubuntu Pro. It is Ubuntu's tenth LTS release.

It is also the LTS that turned on AppArmor's unprivileged user namespace restriction, and the release Canonical rebuilt from scratch after the xz-utils backdoor reached its pre-release archive. Below: every release fact with a citation, the security defaults, the installer and its experimental TPM-backed encryption, build hardening, the five point releases, what changed since 22.04 LTS, and how to upgrade. Every fact and command comes from documentation.ubuntu.com, discourse.ubuntu.com or ubuntu.com, fetched on 23 October 2026.

Key takeaways

• Released 25 April 2024, codename Noble Numbat. The beta slipped a week, from 4 April to 11 April 2024, because Canonical rebuilt every Noble binary after the xz-utils backdoor.
• Kernel 6.8 at release. Desktop installs track the rolling Hardware Enablement (HWE) kernel; servers stay on the 6.8 GA kernel unless you opt in. By 24.04.5 the HWE kernel is 7.0.
• GNOME 46 on the desktop, with a minimal install by default and a new App Center written in Flutter.
• Support: standard security maintenance to 31 May 2029, ESM to May 2034, Legacy add-on to May 2039. Flavours other than Desktop, Server, Cloud and Core get 3 years.
• AppArmor restricts unprivileged user namespaces by default. Unconfined programs can still create them but cannot use capabilities inside them unless a profile allows it.
• Build hardening: _FORTIFY_SOURCE=3 replaces level 2, arm64 gets branch protection, and frame pointers are on by default on 64-bit architectures (later turned off on ppc64el and s390x).
• xz-utils (CVE-2024-3094): Ubuntu's tracker marks every listed release, 24.04 included, as "Not affected". The backdoored version only reached noble-proposed and was removed before it migrated.
• TPM-backed full disk encryption is offered by the installer but labelled experimental in 24.04, with hardware and upgrade limits.
• ufw is installed but off. Turn it on yourself, except on Oracle Cloud images where ufw is not installed at all.
• Upgrade path: from 22.04 LTS once 24.04.1 shipped (29 August 2024); out to 26.04 LTS once 26.04.1 shipped.

What are the Ubuntu 24.04 LTS release facts?

The release announcement lists ten flavours released the same day: Edubuntu, Kubuntu, Lubuntu, Ubuntu Budgie, Ubuntu Cinnamon, Ubuntu Kylin, Ubuntu MATE, Ubuntu Studio, Ubuntu Unity and Xubuntu. The 24.04.5 announcement lists all ten again. The 24.04.4 announcement does not name Ubuntu MATE among the flavours released that day, so MATE users should check that flavour's own channels for 24.04.4 media.

A note on the date. The 24.04 release notes do not carry a release day. We took 25 April 2024 from the "Final Release" row of the official release schedule, and it matches the date of the release team's announcement on Ubuntu Discourse.

What happened when: the 24.04 timeline

One date moved: the 25 April announcement said 24.04.1 was "scheduled for the 15th of August", and the schedule records it on 29 August 2024. The later point releases are in their own table below.

How long is Ubuntu 24.04 LTS supported?

The 24.04 release notes say the release "will be security maintained for 5 years until 31 May 2029." Canonical's release cycle page agrees on May 2029 and adds the rest of the timeline: Expanded Security Maintenance (ESM) and break/bug support to May 2034, and the Legacy add-on to May 2039.

One wording conflict is worth knowing about. The same release notes say users "can choose to extend this to 10 years with Ubuntu Pro or 12 years with the Legacy add-on." Twelve years from April 2024 lands in 2036, not 2039. The release cycle page says May 2039, and the ESM page describes security maintenance "for up to 15 years." We used the release cycle page for the dates in this post, because it is the page Canonical maintains as the lifecycle reference across all releases, but if a contract depends on 2039, confirm it with Canonical in writing.

What each phase covers matters more than the end date:

• Standard security maintenance (to May 2029). Free security updates through the normal Ubuntu archive.
• ESM (to May 2034). The Ubuntu Pro page says ESM "provides 10 years of vulnerability fixes for critical, high and selected medium vulnerabilities across the whole Ubuntu archive, as defined by Ubuntu Priority." That includes Universe.
• Legacy add-on (to May 2039). A paid extension on top of Pro for releases past their ESM date.
• Livepatch. Pro includes rebootless kernel patching "to address high and critical kernel vulnerabilities," per the Pro page.

Ubuntu Pro "is and always will be free for personal use on up to 5 physical machines," per the same page. For a breakdown of what Universe gets and when, see whether Ubuntu patches Universe packages, and for why Ubuntu's priority differs from CVSS, see Ubuntu priority levels versus CVSS.

Flavours are different. The release announcement says maintenance updates are provided "for 5 years for Ubuntu Desktop, Ubuntu Server, Ubuntu Cloud and Ubuntu Core. All the remaining flavours will be supported for 3 years." Kubuntu 24.04, Xubuntu 24.04 and the rest therefore reach the end of their flavour support around April 2027, even though the packages they share with Ubuntu Main stay patched to 2029.

What kernel does Ubuntu 24.04 LTS use?

The release notes say plainly: "Ubuntu 24.04 LTS includes the new 6.8 Linux kernel." The release announcement adds that "The Linux 6.8 kernel now enables low-latency features by default."

Which kernel a given machine runs after that depends on the install type. The kernel lifecycle page says: "Desktop installations of 24.04 default to tracking the HWE stack. Server installations will default to the GA kernel and provide the enablement kernel as optional." It also says the 24.04 HWE stack "follows the Rolling Update Model", meaning a desktop moves to each new HWE kernel as it is published, and some laptops sit on a separate OEM kernel track instead.

Source for every row: the kernel lifecycle page. The page no longer lists the HWE kernels between 24.04.1 and 24.04.4. Point release changelogs add AppArmor feature preseeds for 6.11 and 6.14 kernels (24.04.3 changes, 24.04.4 changes), but no official page we fetched says which point release made each the default, so we do not either. The 6.17 HWE kernel's support ended in July 2026; a desktop that tracks HWE should now be on 7.0, which carries the full 24.04 dates.

What desktop does Ubuntu 24.04 LTS ship?

GNOME 46. The release notes say GNOME "has been updated to include new features and fixes from the latest GNOME release, GNOME 46." Server, Cloud and Core images have no desktop environment.

"The default Ubuntu Desktop installation is now minimal," with an "extended selection" option for LibreOffice, Thunderbird and similar applications. Fewer packages installed means fewer packages to patch. Firefox 124 runs as a native Wayland application, and Thunderbird 115 "is now provided as a Snap package only." The flavours ship their own desktops (KDE Plasma for Kubuntu, Xfce for Xubuntu, LXQt for Lubuntu and so on); their versions are in each flavour's release notes, which we did not fetch, so we do not list them.

What is new in the installer, App Center and networking?

Subiquity reaches the desktop LTS

The release announcement says "Ubuntu Desktop brings the Subiquity installer to an LTS for the first time." The desktop installer was renamed ubuntu-desktop-bootstrap. For fleets, three things matter: a page to side-load an autoinstall.yaml from a network URL, an installer that "is now able to update itself" early in the install, and the return of ZFS guided installs, "without encryption by default." At release, screen reader support was incomplete and OEM installs were not supported yet.

App Center and Firmware Updater

"There is a brand new Ubuntu App Center that replaces the previous Snap Store. The application has been written from scratch using the Flutter toolkit." A separate Firmware Updater application, for amd64 and arm64, applies firmware updates without a store running in the background. On a TPM-encrypted machine, firmware updates interact with boot measurements; see the encryption section below.

Netplan becomes the desktop network backend

Netplan 1.0 shipped with a stable libnetplan1 API and a netplan status --diff subcommand to show differences between configuration and system state. On the desktop, "NetworkManager now uses Netplan as its default settings-storage backend." On upgrade, connection profiles from /etc/NetworkManager/system-connections/ are migrated to /etc/netplan/90-NM-*.yaml, with backups placed in /var/lib/NetworkManager/backups/. Configuration management that writes NetworkManager keyfiles directly should be checked against the new location.

What changed in security: AppArmor and unprivileged user namespaces

This is the change most likely to break something after an upgrade, so it gets the most space.

What a user namespace is and why Ubuntu restricted it

The AppArmor team's specification on Ubuntu Discourse explains the reasoning. User namespaces let an unprivileged user act as root inside an isolated namespace. That is useful: it replaces many setuid programs and lets browsers and container tools build sandboxes. But it also exposes kernel interfaces "that are normally restricted to processes with privileged capabilities (root)" to unprivileged users, which enlarges the kernel attack surface. The spec says unprivileged user namespaces "are now often used as a step in several privilege escalation exploit chains." Its abstract states the goal: allow user namespaces only to applications that "both require the access and are appropriately confined by AppArmor."

How it arrived: 23.10, then 24.04

The 23.10 release notes say the kernel gained "the ability to require programs to have an AppArmor profile in order to use unprivileged user namespaces," but "This restriction is not currently enabled by default." 24.04 turned it on. From the 24.04 release notes:

• "In combination with the apparmor package, the Ubuntu kernel now restricts the use of unprivileged user namespaces. This affects all programs on the system that are unprivileged and unconfined."
• A default profile still allows unconfined, unprivileged programs to create a user namespace, "but will deny the subsequent use of any capabilities within the user namespace."
• Profiles that allow user namespaces ship for common applications from the archive and for popular third party applications; the notes name Google Chrome and Discord.
• The notes expect gaps: "there may be cases where additional profiles are required."

What to do when an application breaks

The release notes list the options in order of preference, and the order matters for security:

1. Give the application an AppArmor profile. AppArmor 4.0 added an unconfined profile flag, so a profile can leave the application otherwise unrestricted while adding the userns permission. The notes show an example for Chrome placed in /etc/apparmor.d/. A full profile is the stronger option.
2. Run the application without its sandbox. The notes call this "not recommended" because it "disables the use of an internal security feature within the application."
3. Turn the restriction off system wide, for one boot or persistently through a file in /etc/sysctl.d/. The notes warn that this "does not mitigate against kernel exploits that abuse the unprivileged user namespaces feature."

The practical rule: fix the profile for the one application, not the whole machine. Our post on AppArmor complain or enforce mode on Ubuntu dev machines covers the profile side. The Ubuntu security docs now describe the feature as current behaviour: AppArmor "can deny unprivileged applications the use of user namespaces."

Other AppArmor changes in the release

AppArmor rules now let OpenSSL and GnuTLS read their configuration files, so system-wide crypto policy is "followed better." A new profile for runc meant containers could not be stopped promptly and were killed with SIGKILL; the release notes link a workaround, and the 24.04.2 changes update the containerd template "to allow confined runc to kill containers."

What other security defaults changed in 24.04?

TLS and APT signing floors

"TLS 1.0, 1.1 and DTLS 1.0 are forcefully disabled." OpenSSL-based software already refused them since 20.04; 24.04 enforces it for GnuTLS too, with openconnect named as "a notable exception." An old appliance that only speaks TLS 1.0 will be refused by 24.04 clients.

APT now requires repositories to be signed with RSA keys of at least 2048 bits, Ed25519 or Ed448. At release this was a warning while Launchpad PPAs were re-signed; the notes say APT 2.8.0 would make it an error, and that affected PPAs must be removed and re-added. See our post on Linux distribution package signing.

APT sources and the proposed pocket

Ubuntu's sources moved from /etc/apt/sources.list to /etc/apt/sources.list.d/ubuntu.sources in deb822 format, so automation that edits the old file needs updating. The default priority of noble-proposed dropped from 500 to 100, and Noble "is the first Ubuntu LTS to pick it up": enabling proposed no longer pulls in every pre-release package, only the ones you select.

Services restart after security updates

"The needrestart package has been modified to systematically restart services if affected by a library upgrade, including in non-interactive scenarios such as unattended-upgrade." Without a restart, "those running daemons will still be exposed to the security issues fixed by the update." You can exclude services in the override_rc section of /etc/needrestart/needrestart.conf. The automatic updates guide confirms unattended-upgrades "is installed by default" and applies security updates "without user interaction." See our posts on unattended-upgrades settings and phased updates.

Removed attack surface

pptpd and bcrelay were removed. OpenSSH no longer depends on libsystemd, a change tied to the xz-utils backdoor (more below). pam_lastlog.so was removed "because it was not Year 2038 compliant", cloud-init dropped DSA SSH host keys, and the LXD snap is no longer preinstalled on Server.

ufw is installed and off

The Ubuntu security docs on firewalls say ufw is "available in Ubuntu, but disabled by default." The exception is Oracle Cloud: the 24.04 notes say ufw "is no longer installed in Oracle Cloud Ubuntu 24.04 LTS+ images," and upgrading there uninstalls it, because it conflicts with the iptables-persistent and netfilter-persistent rules that iSCSI boot relies on. See our ufw first steps post.

Secure Boot

24.04 did not change the Secure Boot chain. The Ubuntu Secure Boot docs describe a shim signed by Microsoft and a GRUB signed by Canonical, shipped in the main archive as shim-signed and grub-efi-amd64-signed (or grub-efi-arm64-signed). TPM-backed encryption builds on this chain. For firmware certificate rotation, see Secure Boot certificates expiring in 2026.

Is TPM-backed full disk encryption supported in 24.04?

Not as a supported feature. It is offered by the installer and labelled experimental.

The 24.04 release notes repeat the 23.10 text: "Starting with Ubuntu 23.10, TPM-backed full-disk encryption (FDE) is introduced as an experimental feature," and "caution is advised as it's still experimental." With it, the TPM releases the disk key at boot instead of a passphrase. Passphrase-based LUKS encryption remains available and is the supported choice.

The documented limits at release:

• Requires TPM 2.0.
• "Only a limited set of hardware is supported."
• No external kernel modules, so "no support of NVIDIA graphics cards."
• "Firmware updates and upgrades to future releases of Ubuntu are not currently supported."
• Incompatible with the Absolute (formerly Computrace) firmware agent: if Absolute is enabled, the machine "will not boot post-installation" with TPM FDE.
• The TPM FDE kernel snap may lack modules such as vmd for NVMe RAID, so that hardware may be unavailable after install.
• A "DA lockout mode" install failure requires clearing the TPM, which loses all keys it protected, including other operating systems' disk encryption keys.

The 24.04.1 changes made the upgrade limit explicit: "prevent upgrades of TPM FDE desktops." If you used TPM FDE on 24.04, plan to reinstall rather than upgrade, and keep the recovery key off the machine. The current hardware-backed encryption how-to covers PIN and recovery key tools; check they apply to your installed version first. Our 26.04 post covers TPM FDE as a supported option.

Frame pointers and other build hardening

Three compiler and packaging changes affect every binary in the archive.

Fortify source level 3. "The gcc compiler and dpkg now defaults to -D_FORTIFY_SOURCE=3 instead of -D_FORTIFY_SOURCE=2 which greatly increases buffer overflow detection and mitigation." The compiler flags docs explain fortify: length-checked versions of unbounded sprintf and strcpy calls when the buffer size is known, and blocking %n format string attacks in writable memory. That page still describes level 2, so the release notes are the source for level 3.

Branch protection on arm64. "dpkg now defaults to use -mbranch-protection=standard which mitigates code reuse attacks on arm64."

Frame pointers. The release announcement says "Ubuntu now enables frame pointers by default on 64-bit architectures to enable CPU and off-CPU profiling for workload optimisation." It is a performance and observability change rather than a security control, and the 24.04 release notes do not mention it; the announcement is the source. The 24.04.1 changes narrowed it: "Disable framepointer on ppc64el" and "Disable framepointer on s390x, leaving only -mbackchain." So frame pointers stay on for the other 64-bit architectures, such as amd64 and arm64.

Year 2038 on armhf. "More than a thousand packages have been updated to handle time using a 64-bit value rather than a 32-bit one" on armhf. It also breaks binary compatibility for some on-disk formats; the notes call out rrdtool databases on armhf, which must be dumped to XML before upgrade and restored afterwards.

What did Ubuntu say about the xz-utils backdoor (CVE-2024-3094)?

The backdoor in xz-utils was discovered while 24.04 was in development, which put Noble closer to it than any other Ubuntu release. Here is what the official Ubuntu sources say, in order. We do not describe how the backdoor worked beyond Ubuntu's own summary.

• 29 March 2024. Canonical's xz/liblzma security update post says Ubuntu was made aware on 28 March 2024 of "an upstream vulnerability that affected the xz-utils source package," and that "The affected library has been removed from our Ubuntu 24.04 LTS (Noble Numbat) proposed builds."
• The tracker entry. The Ubuntu CVE tracker for CVE-2024-3094 rates it Critical priority, CVSS 3 base score 10.0, and explains the priority as "Results in a backdoor in sshd." Its description says malicious code was found "in the upstream tarballs of xz, starting with version 5.6.0." Every listed release, from 14.04 to 24.04 LTS, shows xz-utils as "Not affected." The security team's note says: "The affected version of xz-utils was only in noble-proposed, and was removed before migrating to noble itself. No released versions of Ubuntu were affected by this issue."
• 3 April 2024. The beta delay notice says Canonical decided "to remove and rebuild all binary packages that had been built for Noble Numbat after the CVE-2024-3094 code was committed to xz-utils (February 26th), on newly provisioned build environments." The beta moved from 4 April to 11 April 2024.
• At release. The 24.04 release notes record a structural follow-up: "As per the XZ-utils backdoor, openssh in Ubuntu does not depend anymore on libsystemd, reducing the number of dependencies and making it less prone to future security issues."

In practice, a machine installed from 24.04 release media never had the backdoored library. The only exposure was a development system with noble-proposed enabled before the removal; rebuild any such machine rather than patch it. Our explainers on the xz-utils backdoor and what it means for supply chains go further.

What changed from Ubuntu 22.04 LTS to 24.04 LTS?

The release notes say an upgrade from 22.04 brings "all the changes that happened in the six months since Ubuntu 23.10, as well as the changes in all the interim releases between 22.04 LTS and 24.04 LTS": 22.10, 23.04 and 23.10. This table pulls the headline items from the 24.04 release notes, the 22.04 release notes, the release cycle page and the AppArmor docs.

The server stack moved too: PHP 8.3.6, Nginx 1.24, Apache 2.4.58, containerd 1.7.12, libvirt 10.0.0, Docker 24.0.7, and Kea 2.4.1 replacing the discontinued ISC DHCP server. On Raspberry Pi, 24.04 is the first LTS with Pi 5 images, and there are no more 32-bit armhf Pi images.

A note on compliance. The release cycle page shows FIPS 140-3 as "Pending" for 24.04 on 23 October 2026, while 22.04 shows it as "Achieved." If you need a FIPS 140-3 validated stack today, check the current status before you move a regulated workload.

The interim releases between them

Sources: 22.10 notes, 23.04 notes (the proposed pocket change is attributed to Lunar in the 24.04 notes), 23.10 notes. Each interim got 9 months of support. For every release in one table, see our Ubuntu release history.

What changed in the 24.04 point releases?

Point releases are refreshed install images of the same release with accumulated updates. They do not change the support dates. Each changes page lists bug fixes in Main and Restricted only.

One 24.04.1 event is worth remembering for planning. The release team temporarily suspended upgrades to 24.04.1 because a faster algorithm in the release upgrader left broken kernel header dependencies after upgrade, and earlier upgrades had removed kernel headers entirely. Upgrades were re-enabled on 9 September 2024 after an APT 2.4.13 fix on 22.04 and a fallback in the upgrader. The post says affected systems can run apt install --fix-broken. If you build out-of-tree kernel modules, check that headers are present after any release upgrade.

How do you check and upgrade an Ubuntu 24.04 system?

These steps use only commands from Canonical's docs. They read state first and change nothing until the upgrade steps.

Step 1: Confirm the release

The Ubuntu Desktop docs use this command to show which release you run:

lsb_release --description

On 24.04 the description line names Ubuntu 24.04 and the installed point release.

Step 2: Check the kernel support status

The kernel lifecycle page gives the check for whether your kernel stack is still supported, which matters on desktops that roll through HWE kernels:

hwe-support-status --verbose

To move a server onto the HWE kernel, the same page gives:

sudo apt-get install --install-recommends linux-generic-hwe-24.04

Step 3: Check security coverage

The Pro Client docs explain pro security-status. It counts installed packages by origin (Main, Universe, third party) and flags packages "no longer available for download," which Ubuntu cannot patch for you:

pro security-status
pro security-status --help

Step 4: Check the firewall

From the Ubuntu Server firewall guide:

sudo ufw status
sudo ufw allow 22
sudo ufw enable

Allow SSH before enabling on a remote server, so you do not lock yourself out. Skip ufw on Oracle Cloud images, as described above.

Step 5: Check the user namespace restriction

The 24.04 release notes name the setting. Read it without changing it; 1 means the restriction is on:

cat /proc/sys/kernel/apparmor_restrict_unprivileged_userns

If an application fails because of it, write an AppArmor profile for that application rather than setting the value to 0.

Step 6: Check automatic security updates

From the automatic updates guide, a dry run shows what unattended-upgrades would install:

sudo unattended-upgrade -v --dry-run

Step 7: Upgrade from 22.04 LTS to 24.04 LTS

The Ubuntu Server upgrade guide says to bring the current system fully up to date first, including phased updates, and to reboot if /run/reboot-required exists:

sudo apt update
sudo apt dist-upgrade -o APT::Get::Always-Include-Phased-Updates=true
sudo do-release-upgrade

The guide says "Upgrades from one LTS release to the next one are only available after the first point release," and that the development release flag "is not recommended for production environments." Before you start, check the 24.04 known issues:

• freeradius "will be accidentally removed by the release upgrade tool on upgrades from Ubuntu 22.04 LTS to Ubuntu 24.04 LTS." The removal appears in the summary before anything happens, so read it.
• Interactive prompts appear for grub-pc (choose the boot device) and, if chrony is installed, for its configuration.
• Gluster users of QEMU or Samba must install qemu-block-supplemental or samba-vfs-modules-extra afterwards.
• armhf with rrdtool needs databases dumped to XML before and restored after.

Step 8: Upgrade from 24.04 LTS to 26.04 LTS

The same rule applies on the way out. The Desktop upgrade guide says "LTS upgrades only become available with the first point release, such as 26.04.1." The commands are the same as Step 7. The 26.04 release adds its own blockers, including cgroup v1 hosts and older IBM Z hardware; our Ubuntu 26.04 LTS post lists them, and our post on whether to adopt a new LTS right away covers timing.

Who should stay on 24.04, and who should move?

24.04 has standard security maintenance until May 2029, so nothing forces a move in 2026. Stay on it if you depend on its DISA-STIG or CIS profiles, if you have not checked your hardware against the 26.04 requirements, or if you have not tested your services on the newer stack. Move to 26.04 once you have, especially for desktops where the newer TPM-backed encryption and GNOME matter. If you still run 22.04, its standard support ends in May 2027 on the release cycle page; see our post on 22.04 support dates. If you are choosing between Ubuntu, Debian and Kali for a new machine rather than upgrading, see Ubuntu vs Kali vs Debian.

Common mistakes

• Turning off the user namespace restriction system wide to fix one application. The release notes say this "does not mitigate against kernel exploits." Write a profile instead.
• Assuming ufw is on. It is installed and disabled. On Oracle Cloud it is not installed at all.
• Treating TPM-backed FDE on 24.04 as production ready. It is experimental, blocks release upgrades, and conflicts with Absolute and NVIDIA drivers.
• Assuming the Legacy add-on is 12 years because the release notes say so. The release cycle page says May 2039. Confirm the date your contract relies on.
• Expecting a Kubuntu or Xubuntu 24.04 desktop to be supported to 2029. Flavours get 3 years.
• Leaving a desktop on an expired HWE kernel. The 6.17 HWE kernel's support ended in July 2026. Run the hwe-support-status check from the walkthrough.
• Assuming the xz-utils backdoor reached released Noble. It did not. The risk was confined to pre-release systems with noble-proposed in the window before removal.
• Thinking a patched OS means a patched application. Ubuntu's archive covers what Canonical packages. Language dependencies vendored in your images, and third party packages, are yours to track.

FAQ

When was Ubuntu 24.04 LTS released?

On 25 April 2024, per the "Final Release" row of the official 24.04 release schedule and the release team's announcement on Ubuntu Discourse that day.

What kernel does Ubuntu 24.04 use?

Linux 6.8 at release. Desktops follow the rolling HWE stack, which reached 6.17 in 24.04.4 and 7.0 in 24.04.5. Servers stay on 6.8 unless you install linux-generic-hwe-24.04.

How long is Ubuntu 24.04 supported?

Standard security maintenance until 31 May 2029. With Ubuntu Pro, ESM runs to May 2034, and the Legacy add-on to May 2039 per the release cycle page. Official flavours get 3 years.

Was Ubuntu 24.04 affected by the xz backdoor?

No released version was. Ubuntu's CVE tracker lists 24.04 as "Not affected" and says the backdoored xz-utils "was only in noble-proposed, and was removed before migrating to noble itself." Canonical also rebuilt every Noble binary built after 26 February 2024 on new build environments.

Why does Chrome or another app fail to start sandboxing on Ubuntu 24.04?

Because 24.04 restricts unprivileged user namespaces through AppArmor. Archive packages and popular third party apps have profiles; others may need one. The release notes show how to add a profile using the unconfined flag and the userns permission.

Does Ubuntu 24.04 support TPM-backed full disk encryption?

It offers it in the installer as an experimental feature. It needs TPM 2.0, supports limited hardware, does not work with NVIDIA drivers or Absolute, and blocks release upgrades. Passphrase-based LUKS is the supported choice on 24.04.

Is ufw enabled by default on Ubuntu 24.04?

No. Ubuntu's security docs say ufw is "available in Ubuntu, but disabled by default." Enable it with sudo ufw enable after allowing the services you need.

Can I upgrade from Ubuntu 22.04 to 24.04 now?

Yes. The upgrade has been offered since 24.04.1 on 29 August 2024, and the 24.04.5 announcement says 22.04 users "will be offered an automatic upgrade." Use do-release-upgrade after fully updating the system, and read the known issues first.

Fix it without waiting for upstream

Ubuntu 24.04 patches what Canonical packages, on Canonical's schedule, and only while the release and your subscription tier cover it. The application dependencies and base images you build on top of 24.04 are a separate gap, and that is the part you can close yourself.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

Safeguard scans repositories, container images and SBOM files and matches the components it finds against vulnerability databases. For an image built FROM ubuntu:24.04, that means the OS packages and versions it carries appear next to your application dependencies, so you can see what Canonical's updates cover and what you have to update yourself:

safeguard scan --dir .
safeguard scan --image your-image:tag
safeguard scan --sbom sbom.json

Results are written as JSON under ./output. Safeguard does not patch the host kernel or the Ubuntu archive; that stays with Canonical's updates, ESM and Livepatch.

In this Safeguard CLI session you install the CLI, run safeguard to open the interactive terminal and ask it to fix the lodash CVE in a repository. It reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, prints a summary and pushes nothing. On a 24.04 build host, this is how you bring a service's own dependencies to fixed versions before rebuilding its image on a refreshed base.

Click through it at your own pace, or open it full screen.

This demo sets up the Safeguard runner on your own machine, approves it with its device code, then scans from the terminal. A 24.04 server with five years of standard support left is a sensible host for it, so repositories and images are scanned locally rather than leaving your network. Our guide to how the local runner and offline mode work covers the details.

Click through it at your own pace, or open it full screen.

This demo connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use. Once connected, you can ask which of your projects still carry a component version you are tracking, for example while planning which 24.04 services to rebuild first after a security notice. Our SBOM incident response guide shows the same question asked across a portfolio.

Click through it at your own pace, or open it full screen.

To try it yourself, download Safeguard from safeguard.sh/download and follow the CLI docs.

Quick check

Sources

• Ubuntu release notes: Ubuntu 24.04 LTS
• Ubuntu release notes: Ubuntu 24.04 LTS release schedule
• Ubuntu release notes: Changes in Ubuntu 24.04.1
• Ubuntu release notes: Changes in Ubuntu 24.04.2
• Ubuntu release notes: Changes in Ubuntu 24.04.3
• Ubuntu release notes: Changes in Ubuntu 24.04.4
• Ubuntu release notes: Changes in Ubuntu 24.04.5
• Ubuntu release notes: Ubuntu 22.04 LTS
• Ubuntu release notes: Ubuntu 22.10
• Ubuntu release notes: Ubuntu 23.04
• Ubuntu release notes: Ubuntu 23.10
• Ubuntu release notes: index
• Ubuntu Discourse: Ubuntu 24.04 (Noble Numbat) released
• Ubuntu Discourse: Ubuntu 24.04.3 LTS released
• Ubuntu Discourse: Ubuntu 24.04.4 LTS released
• Ubuntu Discourse: Ubuntu 24.04.5 LTS released
• Ubuntu Discourse: Upgrades to Ubuntu 24.04.1 LTS are enabled again
• Ubuntu Discourse: Xz/liblzma security update
• Ubuntu Discourse: Noble Numbat Beta delayed (xz/liblzma security update)
• Ubuntu Discourse: Unprivileged user namespace restrictions via AppArmor in Ubuntu 23.10 (spec)
• Ubuntu: Release cycle
• Ubuntu: Kernel lifecycle and enablement stack
• Ubuntu: Ubuntu Pro
• Ubuntu: Expanded Security Maintenance
• Ubuntu CVE tracker: CVE-2024-3094
• Ubuntu Security documentation: AppArmor
• Ubuntu Security documentation: Firewall
• Ubuntu Security documentation: UEFI Secure Boot
• Ubuntu Security documentation: Default compiler and linker flags
• Ubuntu Server documentation: Firewalls
• Ubuntu Server documentation: Automatic updates
• Ubuntu Server documentation: How to upgrade your Ubuntu release
• Ubuntu Desktop documentation: Upgrade Ubuntu Desktop
• Ubuntu Desktop documentation: Switch between an LTS and interim release
• Ubuntu Desktop documentation: Configure hardware-backed disk encryption
• Ubuntu Pro Client documentation: What does security-status do?

Last reviewed: 23 October 2026.