Ubuntu 26.04 LTS Resolute Raccoon: Release Facts, Kernel 7.0, Security

Ubuntu 26.04 LTS "Resolute Raccoon" was released on 23 April 2026 with Linux kernel 7.0 and GNOME 50 on Wayland, and its standard security maintenance runs to May 2031 on Canonical's release cycle page (the release notes say April 2031), with Expanded Security Maintenance to May 2036 and the Legacy add-on to May 2041 through Ubuntu Pro.

The first point release, 26.04.1, followed on 27 August 2026, and that is the release that opened the upgrade path from 24.04 LTS. This post lists the facts of the release with a citation for each, walks through what changed since 24.04 LTS "Noble Numbat", and goes deep on the security defaults: AppArmor, the firewall, TPM-backed full disk encryption, Secure Boot, sudo-rs, the Rust core utilities and their known CVEs, cryptography changes and update tooling. Every command comes from Canonical's own documentation, linked in the sources.

Key takeaways

• Released 23 April 2026, codename Resolute Raccoon. Point release 26.04.1 was announced on 27 August 2026.
• Kernel 7.0 for both the GA and the HWE stack at release; the release-cycle page lists 7.0 for 26.04 LTS.
• GNOME 50, Wayland only. The Ubuntu Desktop session no longer offers an X.org session.
• Support: standard security maintenance to May 2031 per the release-cycle page (April 2031 per the release notes), ESM to May 2036, Legacy add-on to May 2041. Flavours other than Desktop, Server, Cloud and Core get 3 years.
• Memory-safe defaults: sudo-rs is the default sudo, and rust-coreutils provides the core utilities, with cp, mv and rm still from GNU. The release notes list 20 known rust-coreutils CVEs.
• TPM-backed full disk encryption is a supported install option on Ubuntu Desktop, with PIN support, recovery key prompts before firmware updates, and documented limitations. 26.04.1 allows it on machines without a hardware root of trust when a PIN or passphrase is set.
• ufw is still installed and off by default. Turn it on yourself.
• Upgrades: from 24.04 LTS or 25.10 only. Systems still booted with cgroup v1, IBM Z z14 or older, and RISC-V boards without RVA23S64 cannot move to 26.04.
• Compliance: FIPS 140-3, DISA-STIG and CIS are all "Planned" for 26.04 on the release-cycle page as of 23 October 2026.

What are the Ubuntu 26.04 LTS release facts?

The release announcement names nine flavours released the same day: Edubuntu, Kubuntu, Lubuntu, Ubuntu Budgie, Ubuntu Cinnamon, Ubuntu Kylin, Ubuntu Studio, Ubuntu Unity and Xubuntu. The 26.04.1 announcement lists all of them except Ubuntu Unity, so Unity users should check that flavour's own channels.

What happened when: the 26.04 timeline

One date moved. The 23 April announcement said 26.04.1 was "scheduled for the 4th of August." It was announced on 27 August, with the automatic 24.04 upgrade to follow "a couple of weeks" later, after backports for rust-coreutils regressions.

How long is Ubuntu 26.04 LTS supported?

Canonical's release cycle page gives four dates for 26.04 LTS: standard security maintenance to May 2031, Expanded Security Maintenance to May 2036, break/bug support to May 2036, and the Legacy add-on to May 2041. The kernel lifecycle page repeats those dates for the 26.04.0 kernel.

The 26.04 release notes phrase it differently: "Ubuntu 26.04 LTS will be supported until April 2031," and with Ubuntu Pro, ESM "will be available for ten years." The two official sources disagree by one month on the end of standard support. We use May 2031 from the release cycle page in our tables because it is the lifecycle reference and lines up with the kernel lifecycle page, and we note April 2031 wherever the release notes are quoted. If a contract or audit depends on the exact month, plan to April.

What each window covers is defined on the Ubuntu Pro page and the ESM page:

• Standard security maintenance covers the Main repository for 5 years with no subscription.
• Ubuntu Pro extends that "to 10 years for the entire Ubuntu Archive (Main and Universe repositories)," for "critical, high and selected medium vulnerabilities" by Ubuntu Priority.
• The Legacy add-on adds 5 more years, for 15 in total.
• Personal use: Ubuntu Pro "is and always will be free for personal use on up to 5 physical machines, or 50 machines for official Ubuntu Community members."

Flavours differ. Both announcements give 5 years to Ubuntu Desktop, Server, Cloud and Core (the GA announcement also names WSL), and "All the remaining flavors will be supported for 3 years."

For Universe coverage, see whether Ubuntu patches Universe packages.

What kernel does Ubuntu 26.04 LTS use?

Ubuntu 26.04 LTS ships Linux 7.0. The summary for LTS users says that on the GA generic stack the kernel moved "from version 6.8 to 7.0," and on the HWE stack "from version 6.17 (25.10 backport) to 7.0." The changes since 25.10 page adds that it is "based on the upstream final release."

Kernel facts from those pages that matter for operations and security:

• Crash dumps are enabled by default on desktop and server installations.
• Kernel Livepatch now supports ARM64, in the release notes' words.
• The real-time kernel is in the main archive, outside Ubuntu Pro, now that the PREEMPT_RT patches are upstream.
• Rust in the kernel is no longer experimental, following the upstream decision.
• cgroupfs is mounted with nsdelegate, memory_recursiveprot and memory_hugetlb_accounting.

Kernel 7.0 is also the HWE kernel for 24.04 LTS: the kernel lifecycle page lists it as "24.04.5 LTS (HWE)", released July 2026. A 24.04 desktop tracking HWE may already run the same kernel series as 26.04.

One known issue: Linux 7.0 "may cause a significant throughput and latency regression on PostgreSQL" unless huge pages are on.

What desktop does Ubuntu 26.04 LTS ship?

GNOME 50. The summary for LTS users walks through what arrived from GNOME 47, 48, 49 and 50 since the GNOME 46 that shipped in 24.04 LTS. The changes that matter most for administrators:

• Wayland only. "GNOME Shell can no longer run as an X.org session." X11 apps run through XWayland. Other desktops such as KDE on X11, Xfce and MATE can still start an X.org session.
• GDM PreLogin and PostSession scripts were removed. Move that logic to PAM session modules such as pam_exec.
• Software & Updates is no longer installed by default. It is still in the archive as software-properties-gtk.
• New default apps: Ptyxis replaces GNOME Terminal, Loupe replaces Eye of GNOME, Papers replaces Evince, Resources replaces System Monitor, and Showtime replaces Totem.
• Security Center, added in 24.10, manages snap permission prompting and, on TPM/FDE systems, encryption PINs and recovery keys.
• Ubuntu Insights replaces Ubuntu Report for opt-in system metrics; earlier consent does not carry over.
• Removable media now mount under /run/media, not /media.

What changed from Ubuntu 24.04 LTS to 26.04 LTS?

If you upgrade from 24.04, you receive everything from the 24.10, 25.04 and 25.10 interim releases plus the 26.04 changes. This table pulls the headline items from the summary for LTS users and the changes since 25.10, with 24.04 values from the 24.04 release notes and the release cycle page.

The server stack moved too: Samba 4.23, Squid 7.2, Dovecot 2.4.2 (new configuration format), HAProxy 3.2, Postfix no longer chrooted by default, SSSD 2.12 running as user sssd instead of root, and a new HWE track for the virtualization stack. The NVIDIA CUDA toolkit and AMD ROCm 7.1.0 are now in the archive.

What are the security defaults in Ubuntu 26.04 LTS?

Here is what the official pages say about each control, and what they do not say.

AppArmor: more profiles, and the user namespace restriction continues

AppArmor is Ubuntu's default mandatory access control system. The Ubuntu security documentation states that "AppArmor provides Mandatory Access Control (MAC) by default," and that SELinux support is compiled in but "AppArmor takes precedence as the enabled security module at boot time."

Since 24.04 LTS, the AppArmor package has gained "many new profiles for applications" (added in 25.04), which the summary for LTS users says "can help mitigate the impact of any exploit in the confined applications." The same section warns that these profiles "may cause breakage for unanticipated uses," and asks users to file Launchpad bugs. Denials are logged to the audit log if auditd is installed, or to syslog otherwise.

Two server packages tightened their confinement in 26.04: OpenLDAP is "Running in AppArmor enforce mode now," and MariaDB, now fully supported in Main, ships "an AppArmor profile tailored for Ubuntu and hardened systemd service." If you keep a customised /etc/apparmor.d/usr.sbin.slapd, the summary warns that slapd now runs as a Type=notify service and your profile needs the @{run}/systemd/notify w, rule, or slapd will time out at start.

The unprivileged user namespace restriction arrived in 24.04. The 24.04 release notes say that "the Ubuntu kernel now restricts the use of unprivileged user namespaces," which "affects all programs on the system that are unprivileged and unconfined." The AppArmor page in the security docs describes the current behaviour: AppArmor "can deny unprivileged applications the use of user namespaces," and applications that need them "must be explicitly allowed by their AppArmor profile." The 26.04 release notes do not list a change to this restriction, so treat it as carried forward. The right fix for an app that breaks is a profile for that app, not switching the restriction off system wide; the 24.04 notes themselves say the system-wide setting "does not mitigate against kernel exploits that abuse the unprivileged user namespaces feature." Our post on AppArmor complain or enforce mode covers the profile side.

Firewall: ufw installed, still off

Nothing changed here. The Ubuntu security docs on firewalls describe ufw as a frontend for iptables that "is available in Ubuntu, but disabled by default," and note that the nftables backend has been the default since 20.10. A fresh 26.04 install has no host firewall rules active until you enable ufw. The Ubuntu Server firewall guide has the commands, shown in the walkthrough below, and our ufw first steps post covers a developer laptop.

TPM-backed full disk encryption

The summary for LTS users lists TPM-backed full disk encryption (TPM/FDE) under Security: "the encryption keys for your disk are automatically generated and stored safely in your computer's Trusted Platform Module," and the disk "unlocks automatically at boot when the TPM verifies that your system hasn't been tampered with." You choose it during installation. The release announcement names it as a headline feature of 26.04.

What improved in 26.04, per the changes since 25.10:

• The installer has "better guidance and readiness checks."
• "PIN support is fully integrated."
• Recovery key prompts during sensitive operations: fwupd now asks for the recovery key before firmware updates that may require it on the next boot.

What 26.04.1 added, per the 26.10 release notes: computers "without a hardware root of trust can now be installed with TPM-backed full disk encryption (FDE), provided that a PIN or passphrase is also set," and "This was already backported in Ubuntu Desktop 26.04.1."

The limitations as of 26.04.0, from the known issues, are real and you should read them before choosing TPM/FDE:

• Some eligible systems may be detected as ineligible.
• If you forget the PIN or passphrase and boot with the recovery key, you "can't remove or replace the passphrase or PIN anymore" and must keep using the recovery key.
• Disk re-encryption is not supported.
• TPM/FDE needs a specific kernel snap that may lack some modules, such as vmd for NVMe RAID.
• "Nvidia drivers are the only out-of-tree kernel drivers supported by TPM/FDE." Other DKMS drivers cannot be installed.

The 26.10 notes add one more for planning: systems on TPM-backed FDE "will not be able to upgrade from Ubuntu 26.04 LTS to Ubuntu 26.10 on release," with support expected during the 26.10 cycle. Our Ubuntu 26.04 install guide walks through the installer choice between passphrase and TPM encryption.

Secure Boot and shim

The Ubuntu Secure Boot documentation explains the chain: firmware validates a Microsoft-signed shim, shim carries Canonical's certificate and validates a Canonical-signed GRUB and kernel, and since 18.04 LTS Secure Boot verifies "bootloader, kernel, and kernel modules." On amd64 and arm64, the signed binaries are shim-signed and grub-efi-amd64-signed or grub-efi-arm64-signed in Main. The 26.04 release notes do not announce a change to this chain.

• Virtual machine firmware: the EDK2 update in 26.04 enables NX "in all Secure Boot variants" of OVMF and drops the separate strictnx variant.
• A kernel module signing bug: the 26.04.1 changes list "intel-ipu7 / intel-ipu7-isys modules are shipped unsigned in latest Resolute kernels, breaking Secure Boot systems" as fixed across kernel flavours. If an Intel camera stopped working on a Secure Boot laptop early in the 26.04 cycle, update to the current kernel.

For firmware certificate rotation, see Secure Boot certificates expiring in 2026.

sudo-rs is the default sudo

From 25.10 onward, "The sudo-rs tool is now the default sudo provider." The original sudo is still available, renamed sudo.ws, and the sudo-ldap package was removed in favour of LDAP authentication through PAM. In 26.04, sudo-rs shows password feedback (asterisks) by default; the changes since 25.10 page says you can turn it off with Defaults !pwfeedback in sudoers, edited through sudo visudo.

The release announcement frames this as "expanded use of memory-safe components." The practical risk is compatibility, so test scripts that rely on unusual sudo options or on sudo-ldap.

rust-coreutils, and the CVEs it shipped with

Also from 25.10: "The core utilities of the operating system are now provided by the rust-coreutils package." The summary is frank that they "are not fully compatible yet," so the GNU tools remain available with a gnu prefix, and "Because of unresolved bugs, the cp, mv, and rm utilities are still from GNU."

The known issues for 26.04 include a section titled "rust-coreutils vulnerabilities" that says "This release includes the following known vulnerabilities" and lists 20 CVE IDs, from CVE-2026-35341 to CVE-2026-35377. That is unusual for a release note, and useful: Canonical shipped an LTS with a published list of open issues in a default component.

Take one example. The Ubuntu CVE tracker entry for CVE-2026-35341, published 22 April 2026, describes a flaw in the uutils mkfifo where an existing file at the target path can have its permissions reset to the default mode, which "potentially" exposes files such as SSH private keys to other local users. Ubuntu rates it Medium priority with a CVSS 3 base score of 7.1. When we fetched the page on 23 October 2026, the status for rust-coreutils on 26.04 LTS was still "Vulnerable", as it was for 26.10 and 24.04 LTS (where rust-coreutils is not the default). If that matters for your threat model, the summary for LTS users gives supported apt install commands to switch to GNU coreutils (coreutils-from-gnu) and back. Our explainer on Ubuntu priority versus CVSS covers why the two ratings differ.

Cryptography and protocol defaults

• OpenSSL 3.5.6 LTS with post-quantum algorithms (ML-KEM, ML-DSA and SLH-DSA) and QUIC support.
• OpenSSH 10.2p1: DSA removed; the hybrid post-quantum key exchange mlkem768x25519-sha256 is available by default; a warning appears for non post-quantum key agreement; and PerSourcePenalties penalises clients that fail to authenticate.
• Apache: TLS 1.0 and 1.1 are disabled, following RFC 8996. The Apache systemd unit now sets MemoryDenyWriteExecute=yes, which breaks the PHP JIT under mod-php; the release notes recommend php-fpm instead.
• Kerberos: arcfour-hmac-md5 and des3-cbc-sha1 are no longer in the default encryption lists.
• OpenLDAP now uses OpenSSL; a leftover GnuTLS cipher string "will prevent slapd from starting after the upgrade."
• Squid 7 removed the ntlm_smb_lm_auth helper, which the notes say "also resolves CVE-2025-21311."

Sandboxed image loading

gdk-pixbuf now uses the glycin parser, written in Rust, for image loading. The changes since 25.10 say glycin "provides significant security benefits thanks to sandboxed image loading."

Updates: unattended-upgrades, Livepatch and Ubuntu Pro

The Ubuntu Server automatic updates guide says Ubuntu "will apply security updates automatically, without user interaction" through unattended-upgrades, "which is installed by default," including ESM when available. Since 24.04, needrestart restarts affected services automatically by default. Adding a third-party repository does not make unattended-upgrades consider it. See our posts on unattended-upgrades settings and phased updates.

Livepatch is part of Ubuntu Pro; the Pro page describes it as rebootless patching for "high and critical kernel vulnerabilities." 26.04 adds ARM64 support. Our Livepatch post explains what still needs a reboot.

Compiler hardening flags

The Ubuntu security docs on default compiler flags list the archive-wide defaults: PIE, BIND_NOW, RELRO, -fcf-protection, _FORTIFY_SOURCE, -fstack-clash-protection and the stack protector. The 26.04 release notes do not announce a new archive-wide default flag. They do note an opt-in feature for Rust: packages built on Launchpad can use cargo-auditable, which embeds JSON dependency metadata in the binary so that "If a CVE is discovered in a popular Rust crate," administrators can check whether a binary is affected.

Package signing and APT 3

APT 3.1 removed the apt-key command: "Signature verification now makes direct use of gpgv," and the notes point to apt-secure(8) for key management. Old repository setup scripts that call apt-key add will fail on 26.04. APT 3 also adds a transaction history (apt history-list). Our post on Linux distribution package signing explains how archive keys work.

Which architectures and hardware does 26.04 support?

The release cycle page lists amd64, armhf, arm64, s390x, riscv64 and ppc64el-p9 for 26.04, the same set as 24.04. The minimums underneath moved:

• RISC-V: "only supports hardware that implements the RVA23S64 ISA profile." As of April 2026, the release notes say no such hardware was available, so the only supported RISC-V platform was QEMU with -cpu rva23s64. 24.04 LTS continues to support RVA20 boards.
• IBM Z: z15 is the minimum. z14 (LinuxONE II) and older cannot install or upgrade; they stay supported on 24.04 LTS.
• Cloud amd64 images are built for AMD64v3. On Google Cloud, Ivy Bridge and Sandy Bridge N1 platforms are no longer supported; on AWS, older families including M1 to M4, C1, C3, C4, R3, R4, I2, G3, P2, P3 and P3dn are not supported.
• i386: PostgreSQL 18 no longer builds for i386, and python3-samba is not built for i386 from 25.04.

Where do FIPS, DISA-STIG and CIS stand for 26.04?

On the release cycle page, fetched on 23 October 2026, 26.04 LTS shows FIPS 140-3, DISA-STIG and CIS all as "Planned". 24.04 LTS shows FIPS 140-3 "Pending" with DISA-STIG and CIS "Achieved", and 22.04 LTS shows all three "Achieved". If you need a validated FIPS module or a published STIG today, stay on 24.04 or 22.04 and recheck the page before migrating.

How do you check and upgrade an Ubuntu 26.04 system?

These steps use only commands from Canonical's docs. They read state first and change nothing until the final steps.

Step 1: Confirm the release

The Ubuntu Desktop docs use this command and show its output:

lsb_release --description
# Description: Ubuntu 26.04 LTS

The 26.04.1 changes include a base-files fix, "/etc/os-release: Fix missing LTS in VERSION", so a system that has not taken updates since 26.04.0 may show a VERSION value without "LTS". Install updates before you rely on that file in inventory scripts.

Step 2: Check the kernel and HWE status

uname -r prints the running kernel; the Ubuntu NVIDIA driver docs use it the same way to match modules to the running kernel. The kernel lifecycle page gives the support check:

uname -r
hwe-support-status --verbose

Step 3: Check Ubuntu Pro and security coverage

The Pro Client docs explain pro security-status, which counts packages by Main, Universe, third party and "no longer available for download," and tells you whether the machine is still receiving patches. The status columns explainer covers pro status.

pro status
pro status --all
pro security-status
pro security-status --esm-apps

The third-party and "no longer available" counts are packages Ubuntu will not patch for you.

Step 4: Check the firewall and AppArmor

From the Ubuntu Server firewall guide:

sudo ufw status verbose
sudo ufw enable

Allow the services you need (for example SSH on a remote server) before you enable it, so you do not lock yourself out. To read the user namespace restriction setting named in the 24.04 release notes, read the value without changing it; 1 means the restriction is on:

cat /proc/sys/kernel/apparmor_restrict_unprivileged_userns

Step 5: Check unattended-upgrades and the transaction history

From the automatic updates guide and the APT 3 section of the summary:

sudo unattended-upgrade -v --dry-run
apt history-list

Step 6: Optional, add a PIN to TPM-backed FDE

From the hardware-backed encryption how-to:

sudo snap install snap-tpmctl
sudo snap-tpmctl add-pin

Store the recovery key first; see the PIN limitation above.

Step 7: Upgrade from 24.04 LTS

The Ubuntu Server upgrade guide says to bring the current system fully up to date, including phased updates, and check /run/reboot-required:

sudo apt update
sudo apt dist-upgrade -o APT::Get::Always-Include-Phased-Updates=true
sudo do-release-upgrade

The Desktop upgrade guide says LTS upgrades "only become available with the first point release, such as 26.04.1." The 26.04.1 changes set Prompt=lts for resolute in the release upgrader. The 26.04.1 announcement mentions do-release-upgrade -d for people who want to move before the automatic offer, while the server guide says the -d flag "is not recommended for production environments." On production, wait for the normal offer.

Before you start, check the blockers the 26.04 notes list:

• cgroup v1: "Ubuntu installations running cgroup v1 will not be allowed to upgrade to Ubuntu 26.04 LTS."
• IBM Z z14 or older: the upgrader blocks the upgrade.
• 22.04 or 25.04: upgrade to 24.04 LTS or 25.10 first.
• Samba AD DC without the samba-ad-dc package: install it before upgrading.
• MySQL 8.4 locks out accounts using mysql_native_password unless you migrate them or enable it explicitly.
• Squid, Dovecot and OpenLDAP configurations that fail on start after the upgrade, as described above.
• The "Foreign Packages Installed" prompt may be too long to scroll; cancel, remove unneeded foreign packages, and restart.

Who should move to 26.04 now, and who should wait?

New desktop installs should start on 26.04.1. Servers can move once you have tested the services you run, especially Squid, Dovecot, OpenLDAP, MySQL, Samba AD or mod-php.

Stay on 24.04 for now if you need FIPS 140-3, a published DISA-STIG or CIS profile for this release, if you run on z14 or RVA20 RISC-V hardware, if your hosts still boot with cgroup v1, or if tooling depends on GNU coreutils behaviour you have not tested. 24.04 has standard support until May 2029. Our post on whether to adopt a new LTS right away covers this trade-off in general.

Common mistakes

• Assuming 26.04 turns on a firewall. ufw is installed and disabled by default, as in every recent release.
• Using the wrong end date. The release notes say April 2031 and the release cycle page says May 2031. Pick one source per document and say which.
• Assuming a flavour gets five years. The announcements give flavours other than Desktop, Server, Cloud and Core three years.
• Disabling the user namespace restriction globally to fix one app. Write or adjust the app's AppArmor profile instead.
• Treating rust-coreutils as fully patched. The release notes list 20 known CVEs, and the tracker showed CVE-2026-35341 still "Vulnerable" on 26.04 on 23 October 2026.
• Losing the TPM/FDE recovery key. You cannot retrieve the old key, only replace it while logged in.
• Running do-release-upgrade -d on production to skip the wait for the point release.
• Keeping apt-key add in provisioning scripts. The command no longer exists in APT 3.
• Forgetting container hosts. 26.04 containers will not run on a cgroup v1 host, and 26.04 hosts cannot run containers that need cgroup v1.
• Ignoring Universe and third-party packages. Standard support covers Main; pro security-status shows what falls outside it.

FAQ

When was Ubuntu 26.04 LTS released?

On 23 April 2026, according to the 26.04 release notes and the release announcement. The first point release, 26.04.1, was announced on 27 August 2026.

What kernel does Ubuntu 26.04 use?

Linux 7.0, based on the upstream final release, for both the GA and HWE stacks at release. The release cycle page lists 7.0 for 26.04 LTS. The same 7.0 series reached 24.04.5 as its HWE kernel in July 2026.

How long is Ubuntu 26.04 LTS supported?

Standard security maintenance to May 2031 per the release cycle page (April 2031 in the release notes), ESM through Ubuntu Pro to May 2036, and the Legacy add-on to May 2041. Most flavours get three years.

Can I upgrade from Ubuntu 22.04 directly to 26.04?

No. The 26.04 release notes say users on 22.04 LTS or 25.04 "must first upgrade to either Ubuntu 24.04 LTS or 25.10" before moving to 26.04. If you are still on 22.04, see our post on 22.04 support dates.

When can I upgrade from 24.04 to 26.04?

After 26.04.1. The 26.04.1 announcement on 27 August 2026 said the automatic offer would follow "a couple of weeks" later, after backports for rust-coreutils regressions.

Does Ubuntu 26.04 use sudo-rs?

Yes. sudo-rs has been the default sudo provider since 25.10, and 26.04 inherits it with password feedback on by default. The original sudo is available as sudo.ws.

Does Ubuntu 26.04 have a firewall enabled by default?

No. ufw is installed but disabled by default. Enable it with sudo ufw enable after allowing the services you need.

Does Ubuntu 26.04 support TPM full disk encryption?

Yes, as an installer option on Ubuntu Desktop, with PIN or passphrase support. From 26.04.1 it can also be used on machines without a hardware root of trust if a PIN or passphrase is set. Read the documented limitations first.

Is Ubuntu 26.04 FIPS certified?

Not yet. The release cycle page lists FIPS 140-3, DISA-STIG and CIS as "Planned" for 26.04 as of 23 October 2026.

Fix it without waiting for upstream

On a new LTS, the operating system packages are the part Canonical patches for you through USNs and ESM. The part it does not patch is the application layer you build on top: the npm, PyPI, Maven, Go and Rust dependencies in your services, and the third-party packages that pro security-status counts as outside Ubuntu's coverage. Moving a container base image to 26.04 does nothing for a vulnerable library pinned in your lockfile.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

Safeguard scans repositories, container images and SBOM files and matches the components it finds against vulnerability databases, so an image built on an Ubuntu base shows which OS packages and versions it carries next to your application dependencies:

safeguard scan --dir .
safeguard scan --image your-image:tag
safeguard scan --sbom sbom.json

Results are written as JSON under ./output, and the platform shows every project that contains a given component and version. Safeguard does not patch the host kernel or the Ubuntu archive for you; that stays with Canonical's updates, ESM and Livepatch.

In this Safeguard CLI session you install the CLI, run safeguard to open the interactive terminal and ask it to fix the lodash CVE in a repository. It reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, prints a summary and pushes nothing. After a release upgrade, this is how you bring a service's own dependencies to fixed versions before you rebuild it on the new base.

Click through it at your own pace, or open it full screen.

This demo sets up the Safeguard runner on your own machine, approves it with its device code, then scans from the terminal. A 26.04 server is a natural host for it, so repositories and images built on the new base are scanned locally rather than leaving your network. Our guide to how the local runner and offline mode work covers the details.

Click through it at your own pace, or open it full screen.

This demo connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use. Once connected, you can ask Claude which of your projects still carry a component version you are tracking, for example while you plan which services to rebuild on 26.04 first.

Click through it at your own pace, or open it full screen.

To try it yourself, download Safeguard from safeguard.sh/download and follow the CLI docs.

Quick check

Sources

• Ubuntu release notes: Ubuntu 26.04 LTS
• Ubuntu release notes: Ubuntu 26.04 LTS summary for LTS users
• Ubuntu release notes: Ubuntu 26.04 LTS changes since 25.10
• Ubuntu release notes: Changes in Ubuntu 26.04.1
• Ubuntu release notes: Ubuntu 26.10
• Ubuntu release notes: Ubuntu 24.04 LTS
• Ubuntu Discourse: Ubuntu 26.04 ("Resolute Raccoon") LTS released
• Ubuntu Discourse: Ubuntu 26.04.1 LTS released
• Ubuntu Discourse: Ubuntu 26.04 LTS (Resolute Raccoon) Beta released
• Ubuntu: Release cycle
• Ubuntu: Kernel lifecycle and enablement stack
• Ubuntu: Ubuntu Pro
• Ubuntu: Expanded Security Maintenance
• Ubuntu CVE tracker: CVE-2026-35341
• Ubuntu Security documentation: Privilege restriction
• Ubuntu Security documentation: AppArmor
• Ubuntu Security documentation: Firewall
• Ubuntu Security documentation: UEFI Secure Boot
• Ubuntu Security documentation: Default compiler and linker flags
• Ubuntu Server documentation: Firewalls
• Ubuntu Server documentation: Automatic updates
• Ubuntu Server documentation: How to upgrade your Ubuntu release
• Ubuntu Desktop documentation: Upgrade Ubuntu Desktop
• Ubuntu Desktop documentation: Switch between an LTS and interim release
• Ubuntu Desktop documentation: Install NVIDIA drivers
• Ubuntu Desktop documentation: Configure hardware-backed disk encryption
• Ubuntu Pro Client documentation: What does security-status do?
• Ubuntu Pro Client documentation: The pro status output explained

Last reviewed: 23 October 2026.