Ubuntu 18.10 to 23.10: Every Interim Release and What Each Changed

Between 18.04 LTS and 24.04 LTS, Canonical shipped nine interim releases: 18.10 Cosmic Cuttlefish, 19.04 Disco Dingo, 19.10 Eoan Ermine, 20.10 Groovy Gorilla, 21.04 Hirsute Hippo, 21.10 Impish Indri, 22.10 Kinetic Kudu, 23.04 Lunar Lobster and 23.10 Mantic Minotaur. Their kernels ran from Linux 4.18 to 6.5, each was supported for nine months, and all nine are now end of life, the last one in July 2024.

They matter for two reasons. Most security defaults on 22.04 and 24.04 were tried out here first, and interim releases still turn up in old container images that no longer get any security updates. Every fact below comes from Canonical's release notes, release schedules and announcements, fetched on 23 October 2026; anything those pages do not state is marked.

Key takeaways

• Nine releases, nine months each. Every release notes page from 18.10 to 23.10 states a nine month support lifespan and a named end month, from July 2019 for 18.10 to July 2024 for 23.10.
• None has ESM. Canonical's release cycle page describes interim releases as having "only 9 months of updates". Expanded Security Maintenance through Ubuntu Pro extends LTS releases, not interims.
• Kernels: 4.18, 5.0, 5.3, 5.8, 5.11, 5.13, 5.19, 6.2 and 6.5, in release order, per each release's notes.
• Desktop: GNOME 3.30, 3.32, 3.34, 3.38, then GNOME 40 applications in 21.04 (the notes say the new shell was not yet included), GNOME 40 in 21.10, and GNOME 43, 44 and 45 in 22.10, 23.04 and 23.10.
• Confirmed milestones: i386 dropped as a host architecture (19.10), experimental ZFS on root (19.10), the first Raspberry Pi desktop image (20.10), Wayland by default on most configurations (21.04), PipeWire as the default audio server (22.10), a new Flutter installer backed by subiquity (23.04), and experimental TPM-backed full disk encryption (23.10).
• Security hardening: stack clash and control-flow protection in GCC (19.10), nftables as the firewall backend (first stated in 20.10), SBAT capable shim and GRUB (21.04), phased updates in APT (21.04), AppArmor support for restricting unprivileged user namespaces (22.10, opt-in kernel switch in 23.10, on by default in 24.04 LTS).
• If you find one running today, do not try to patch it in place. Rebuild on a supported LTS. The check commands are in the walkthrough below.

What are the Ubuntu interim releases from 18.10 to 23.10?

The table gives one row per release. Released gives an exact day only where an official page states it; for the earlier releases the notes do not carry a date, so the table gives the month that the version number encodes. Kernel and Desktop are from each release's notes on documentation.ubuntu.com. Support end is the month each release's own notes state.

Server, cloud and Raspberry Pi server images in these releases have no desktop environment. The flavours (Kubuntu, Lubuntu, Xubuntu, Ubuntu MATE, Ubuntu Budgie, Ubuntu Studio, Ubuntu Kylin, and from the 23.04 notes also Edubuntu, Ubuntu Unity and Ubuntu Cinnamon) ship their own desktops; each release's notes link to the flavour release notes rather than restating them. The 23.04 and 23.10 announcements both say "Maintenance updates will be provided for 9 months for all flavours" released that day.

Where the official pages disagree or stay silent

• Release days. The release notes for 18.10 to 23.10 do not state a release day. For 22.10, 23.04 and 23.10 we used the "Final Release" row of the release schedules on Ubuntu Discourse: Kinetic Kudu (October 20), Lunar Lobster (April 20) and Mantic Minotaur (October 12). The Discourse copies of the 23.04 and 23.10 release announcements are dated 21 April 2023 and 16 October 2023 in the forum's metadata. Our Ubuntu release history hub gives 21 April 2023 for 23.04 from the announcement; this post uses the schedule's date in the table and gives both. We could not find an official schedule page for 18.10 to 21.10 on documentation.ubuntu.com or Discourse, so those days are not stated.
• Support end months. The release cycle page today states the nine month rule but no longer lists these old interims individually. Each release's own notes state the end month, which is what the table uses. The hub's master table shows the end month as not stated for 18.10 and 19.04; the notes for both do state it (July 2019 and January 2020).
• nftables. The sentence "nftables is now the default backend for the firewall" appears under Security Improvements in the 20.10, 21.04 and 21.10 notes, and again in 22.04 LTS. We treat 20.10 as the first release where it is stated.

18.10 Cosmic Cuttlefish: OpenSSL 1.1.1 and TLS 1.3

The 18.10 release notes say the release "was supported for 9 months until July 2019" and recommend 18.04 LTS for anyone who needs long term support.

Kernel and toolchain. 18.10 is "based on the Linux release series 4.18", against the 4.15 kernel in 18.04 LTS. The notes list KVM support for AMD Secure Encrypted Virtualization among the kernel changes. The toolchain moved to glibc 2.28 and GCC 8.2.

Security relevant changes.

• OpenSSL 1.1.1. The headline security change. The notes describe it as the "long-term support series" with support for TLS 1.3, and say "Multiple client and server applications have been enabled to use TLSv1.3 by default". The older 1.0.2 series stayed available but was "expected to be removed from the next Ubuntu release".
• Fingerprint login. Fingerprint libraries were "promoted to main to allow unlocking with fingerprints". Packages in Main get Canonical's security maintenance, so this matters for whether a fix arrives.
• Encrypted volumes. GNOME Disks gained VeraCrypt support. A known issue warns that the installer "might produce systems where packages such as cryptsetup are autoremovable", and tells users on encrypted systems to be cautious with autoremove.

Platform changes. The notes say i386 users "will not be allowed to upgrade to Ubuntu 18.10" because dropping that architecture was being evaluated. That was the first visible step toward the 19.10 change below.

19.04 Disco Dingo: kernel 5.0 and GNOME 3.32

The 19.04 release notes state support "for 9 months until January 2020".

Kernel and toolchain. "Ubuntu 19.04 is based on the Linux release series 5.0."

Desktop. GNOME 3.32, with fractional scaling in the Wayland session and a new "Safe Graphics Mode" GRUB entry for problem graphics cards.

Security relevant changes.

• Per guest AppArmor in libvirt. libvirt 5.0 allows GL graphics and mediated devices "while still being guarded by custom apparmor profiles generated per guest".
• Secure Boot known issue. On Secure Boot systems with Broadcom wireless, the bcmwl DKMS module could be left uninstalled after reboot because of "a dkms tooling regression". The workaround in the notes is to reinstall bcmwl-kernel-source.

What changed versus 18.10. A one point kernel jump (4.18 to 5.0), GNOME 3.30 to 3.32, and Samba moving to Python 3 only. No new default security policy is stated in the notes.

19.10 Eoan Ermine: i386, ZFS on root and compiler hardening

The 19.10 release notes state support "for 9 months until July 2020". This release carries more security relevant change than any other interim in the run before 22.10.

Kernel and toolchain. "Ubuntu 19.10 is based on the Linux release series 5.3." The notes highlight pidfd support "for avoiding races cause by pid reuse" and io_uring, and the default kernel and initramfs compression moved to lz4.

Security relevant changes.

• Compiler hardening. Under Security Improvements: "additional default hardening options enabled in GCC, including support for both stack clash protection and control-flow integrity protection. All packages in main have been rebuilt to take advantage of this, with a few exceptions." This built on 18.04's position independent executables and immediate binding.
• Chromium as a snap only. "The Chromium browser is only available as a snap in 19.10." This moved browser updates for Chromium onto the snap channel rather than the deb archive.

i386 dropped (confirmed). The notes say: "Support for i386 as a host architecture is dropped in 19.10", and i386 users "will not be presented with an upgrade to Ubuntu 19.10". The 20.04 LTS notes repeat that i386 host support "was dropped in 19.10".

ZFS on root (confirmed, experimental). "Support for ZFS as the root filesystem is added as an experimental feature in 19.10", with the installer able to create the ZFS layout automatically. A known issue notes that the confirmation dialog could show ext4 instead of ZFS.

Other changes. MySQL moved to 8.0, Raspberry Pi images gained Pi 4 support, and the notes say "Machines with unattended upgrades configured will automatically get those cloud-init updates."

20.10 Groovy Gorilla: nftables and the Raspberry Pi desktop

The 20.10 release notes state support "for 9 months until July 2021" and point long term users to 20.04 LTS.

Kernel and toolchain. "Ubuntu 20.10 includes the 5.8 Linux kernel". The toolchain moved to glibc 2.32 and GCC 10.

Security relevant changes.

• nftables. The notes' Security Improvements section has one line: "nftables is now the default backend for the firewall."

Raspberry Pi desktop (confirmed). "Ubuntu 20.10 is the first Ubuntu release to feature desktop images for the Raspberry Pi 4." The image is arm64 only and supported on Pi 4 models with at least 4 GB of RAM. U-Boot was removed from the default Pi boot sequence, enabling USB and network boot.

Desktop. GNOME 3.38.

21.04 Hirsute Hippo: Wayland by default, SBAT and phased updates

The 21.04 release notes state support "for 9 months until January 2022". For security, 21.04 is the busiest release in this run.

Kernel and toolchain. "Ubuntu 21.04 includes the 5.11 Linux kernel." Listed kernel changes include support for Intel SGX enclaves, running SEV-ES guests under KVM "to protect guest register state from the hypervisor", and "io_uring restriction support to facilitate secure sharing of rings to less-trusted processes".

Security relevant changes.

• Secure Boot and SBAT. "Secureboot on x86_64 (amd64) and AArch64 (arm64) have been improved to include SBAT capable shim, grub2, fwupd." SBAT is the mechanism that lets a whole generation of vulnerable boot components be revoked without listing every binary.
• nftables. Repeated as the default firewall backend.
• Wayland by default (confirmed). "Wayland is now the default on most configurations, which features better security and performance."
• Smartcard login. "Added support for smartcard authentication (via pam_sss)."
• Recovery key for encrypted installs. "The installer includes support for specifying a recovery key, which can be used to decrypt the disk if the password is forgotten."
• PipeWire. Support was enabled to restore screen recording under Wayland and to give "better audio handling for sandboxed applications". It was not yet the default audio server; that came in 22.10.
• Phased updates in APT. "APT now respects phased updates." The linked Discourse thread explains that phasing had previously been done only by update-manager on desktops, and that the APT implementation "works on servers, raspberry pis, and containers, too". Some updates are held back on some machines while they are phased, decided from the machine ID, the package name and version. The thread says chroots and systems without /etc/machine-id were excluded at first.
• needrestart on servers. "needrestart is installed by default on Ubuntu Server." It prompts to restart services whose libraries were updated.
• Hardened server packages. Chrony 4.0 enabled its seccomp filter by default; SSSD "now supports only openssl cryptography"; Samba deprecated SMBv1 only authentication options.

GNOME version. The notes say "the new shell version hasn't been included yet" while applications were mostly at GNOME 40. They do not name the shell version, so we do not either.

21.10 Impish Indri: GNOME 40, cgroup v2 and the Firefox snap

The 21.10 release notes state support "for 9 months until July 2022".

Kernel and toolchain. Linux 5.13. GCC moved to 11.2.0 and glibc to 2.34.

Security relevant changes.

• nftables. Repeated again as the default firewall backend.
• cgroup v2. "systemd is being switched to the 'unified' cgroup hierarchy (cgroup v2) by default." Container runtimes and some monitoring tools behave differently under cgroup v2, which is why this is worth knowing when you move older workloads forward.
• Firefox as a snap. "Firefox 93 is now seeded as a snap by default, instead of a deb package." The snap is jointly maintained by Mozilla and Canonical, and the deb stayed in the archive "for the lifetime of Ubuntu 21.10".
• Recovery key. The installer's recovery key became "optional, stronger and editable".
• Server crypto changes. Open vSwitch 2.16 "Removed support for 1024-bit Diffie-Hellman key exchange, which is now considered unsafe", and cloud image MD5SUMS and SHA1SUMS files were deprecated in favour of SHA256 from 22.04.

Known issue worth noting. The ZFS driver in the 5.13.0-19 kernel "contains a bug that can result in filesystem corruption", and ZFS users were told to wait for the first kernel stable release update before upgrading.

Desktop. GNOME 40. Wayland sessions became available with the NVIDIA proprietary driver.

22.10 Kinetic Kudu: user namespace restriction support and PipeWire

The 22.10 release notes state support "for 9 months until July 2023". The release schedule puts final release on October 20.

Kernel and toolchain. "Ubuntu 22.10 is shipped with the new 5.19 Linux kernel." Listed features include a faster random number generator ("entropy extractor switched from SHA1 to BLAKE2s").

Security relevant changes.

• AppArmor and unprivileged user namespaces. "AppArmor gained support for restricting access to unprivileged user namespaces. This allows a system administrator to configure their system so that only applications and services which are confined by an appropriate AppArmor profile can use this feature." This is the first of three steps that ended with the restriction being on by default in 24.04 LTS.
• Socket activated SSH. "openssh now uses systemd socket activation by default." The 24.04 notes later confirm this was the default "Since Ubuntu 22.10".
• OpenVPN cipher defaults. When no data ciphers are set, the default becomes AES-256-GCM, AES-128-GCM and CHACHA20-POLY1305, which affects users of older ciphers such as AES-256-CBC.
• runc 1.1.2. The notes say "This new version contains an important CVE fix". They do not name the CVE, so neither do we.
• Known issue: Secure Boot and DKMS. "The dkms package is not currently able to sign kernel modules which it builds", which affected fresh installs with Broadcom wireless and Secure Boot.

PipeWire (confirmed). "The default audio server is now PipeWire instead of PulseAudio."

Desktop. GNOME 43, with many apps moved to GTK4 and libadwaita.

23.04 Lunar Lobster: the new installer

The 23.04 release notes state support "for 9 months until January 2024". The release schedule gives April 20 for final release; the release announcement on Discourse is dated 21 April 2023.

Kernel and toolchain. "Ubuntu 23.04 is shipped with the new 6.2 Linux kernel." Ubuntu specific kernel features include a "Newer LSM stacking and AppArmor patch set".

New installer (confirmed). "The default Ubuntu Desktop installer is now a Flutter app backed by subiquity and packaged as a snap." The announcement says it unifies the server and desktop installation engine so the same autoinstall configuration works for both. Security relevant details in the notes:

• The installer "Installs the available security updates on the target system".
• "MOK Enrollment is not yet supported", so drivers that need Machine Owner Key enrollment for Secure Boot had to be enrolled after installation.
• The legacy installer stayed available in case of problems.

Other security relevant changes.

• CA bundle. "The ca-certificates package has been updated to the 2.60 version of the Mozilla certificate authority bundle."
• More AppArmor profiles in enforce mode. rsyslog's existing profile, previously disabled, was reworked and enabled in enforce mode, and isc-kea gained a new profile that "also defaults to enforce mode".
• Container runtimes. Docker 20.10.21 with "many security and bug fixes".

Desktop. GNOME 44.

23.10 Mantic Minotaur: TPM-backed FDE preview and the userns switch

The 23.10 release notes state support "for 9 months until July 2024". The release schedule gives October 12 for final release, and the announcement says "Security takes center stage in this release".

Kernel and toolchain. "Ubuntu 23.10 includes the new 6.5 Linux kernel." Ubuntu specific changes include zstd compressed kernel modules and a new AppArmor and LSM stacking patch set. GCC moved to 13.2.0 and glibc to 2.38.

TPM-backed full disk encryption (confirmed, experimental). "Starting with Ubuntu 23.10, TPM-backed full-disk encryption (FDE) is introduced as an experimental feature, building on years of experience with Ubuntu Core." The TPM manages the decryption key so no passphrase is needed at boot on supported platforms, and the announcement says keys are "only released by authenticated boot software". The notes list the limits: it requires TPM 2.0, only a limited set of hardware is supported, and there is no support for external kernel modules, so no NVIDIA graphics. Known issues add that it is incompatible with Absolute firmware security software and may lack modules such as vmd for NVMe RAID. Passphrase based FDE remained available.

Unprivileged user namespace restriction (opt-in). The notes say the kernel "now has the ability to require programs to have an AppArmor profile in order to use unprivileged user namespaces". It was "not currently enabled by default", and when enabled it affects all unprivileged, unconfined programs. Canonical called it "the first step towards trying to mitigate the larger attack surface presented by unprivileged user namespaces". A new AppArmor unconfined profile flag was added so an application can be allowed the userns permission without a full profile. The persistent setting the notes give for turning the restriction on is a file at /etc/sysctl.d/60-apparmor-namespace.conf containing:

kernel.apparmor_restrict_unprivileged_userns=1

Other security relevant changes.

• PPA keys. add-apt-repository now adds PPAs as deb822 .sources files. The announcement explains that the key is "directly embedded into the file's signed-by field to create a 1:1 mapping between the PPA and its key". That ties each third party repository to one signing key rather than a shared keyring.
• Minimal by default. "The default Ubuntu Desktop installation is now minimal", with an "Expanded installation" option. Fewer default packages means fewer packages to patch.
• ZFS guided install returns. A new implementation in the subiquity based installers, "without encryption by default".
• App Center and Firmware Updater. A new App Center replaced the Snap Store, and a standalone Firmware Updater was added.
• Raspberry Pi SSH default. "Ubuntu 23.10 changes the default cloud-init configuration to disable password-based authentication with the SSH server" on Pi images.
• Docker. The deprecated AUFS and legacy overlay storage drivers were removed.

Desktop. GNOME 45. Firefox runs as a native Wayland application.

What did each interim change compared with the release before it?

This table compares each release with its immediate predecessor. The first row compares 18.10 with 18.04 LTS, using the 18.04 release notes for the baseline.

Which interim changes became LTS defaults?

The point of the interim releases, in Canonical's own framing on the release cycle page, is to give "users and teams who move fast" the latest kernels and toolchains, while "production environments should use the LTS version". In practice, the interims are where LTS defaults are tested. Here is what the 20.04, 22.04 and 24.04 notes carry forward.

Two conclusions follow. If you went straight from 18.04 to 20.04, you skipped mostly toolchain changes; the big security defaults (Wayland, nftables, phased updates, Firefox snap, OpenSSL 3) landed for LTS users in 22.04. If you went from 22.04 to 24.04, the unprivileged user namespace restriction is the change most likely to break existing software, and its history in 22.10 and 23.10 explains why the 24.04 notes list ways to give an application the userns permission. For the LTS side of the story, see what shipped in 20.04 LTS, what shipped in 22.04 LTS and 24.04 LTS Noble Numbat. For the release before this run, see 18.04 LTS Bionic Beaver.

What about HWE kernels?

Several of these interim kernels reached LTS machines through the Hardware Enablement stack. The kernel lifecycle page says the 18.04, 20.04 and 22.04 HWE stacks "follow the Rolling Update Model", and that desktop installs of 20.04 and 22.04 "default to tracking the HWE stack" while servers default to the GA kernel. The page lists only the final HWE kernel for each LTS (5.4 on 18.04.5, 5.15 on 20.04.5, 6.8 on 22.04.5), so it does not state which interim kernels a desktop passed through. It does show that an HWE kernel taken from an interim ends with that interim: 6.17 on 24.04.4 ended in July 2026, the same month as 25.10.

Why do interim releases end after nine months?

Because they are designed as stepping stones. Each interim is supported for three months past the next interim's release, which gives users time to move up. The release cycle page sets out the trade plainly: interims "provide cutting-edge features and hardware support every six months, but with only 9 months of updates", while LTS releases "receive 5 years of standard security maintenance" and can be extended with Ubuntu Pro. ESM, per the same page, "extends the life of LTS releases"; the page describes ESM and the Legacy add-on only for LTS releases. Our explainer on the Ubuntu release support lifecycle covers the full model.

So an interim release has no long tail. Nine months after release, Canonical stops publishing security updates for it. Every Ubuntu Security Notice after that date that affects the kernel, OpenSSL, glibc, sudo, OpenSSH or anything else in the base system is unpatched on that machine. The archived notes for these releases now open with a banner: "WARNING: Release reached End of Life".

What this means for containers pinned to an interim tag

Container images are where interim releases linger. A Dockerfile written in 2021 that starts from an Ubuntu 21.04 or 21.10 base image still builds the same way today, and nothing in the build warns you that the base stopped getting fixes in 2022. Rebuilding does not help: the packages inside are frozen at the versions that existed when the release reached end of life. Three practical points:

• Check the image, not the host. Inside a container, the release is in /etc/os-release, not in the host's kernel.
• Treat any interim codename as a finding. cosmic, disco, eoan, groovy, hirsute, impish, kinetic, lunar and mantic in an image's os-release file or APT sources means the base has had no security updates since the month in the table above.
• Move to an LTS base, not the next interim. An image on 23.10 that you move to 26.10 will be end of life again in July 2027. Moving to 24.04 or 26.04 LTS gives five years of standard support and more with Ubuntu Pro.

Our guides on checking whether a base image operating system is end of life and base image support dates for Debian, Ubuntu and Alpine cover doing this at scale.

How do you check whether a machine or image is on one of these releases?

These steps use only commands documented on Canonical's own pages, fetched on 23 October 2026.

Step 1: Read the release and codename

The lsb_release manual page says the all option shows "all of the above information": distributor, description, release and codename.

lsb_release -a

In minimal containers lsb_release is often missing. Read the file directly; the os-release manual page documents fields such as VERSION_ID and VERSION_CODENAME:

cat /etc/os-release

If VERSION_ID is 18.10, 19.04, 19.10, 20.10, 21.04, 21.10, 22.10, 23.04 or 23.10, the machine or image is on an end of life interim release.

Step 2: Check kernel support status

The kernel lifecycle page gives this command to check whether your kernel and enablement stack are still supported:

hwe-support-status --verbose

On an LTS machine that tracks HWE this shows whether the current kernel is still in support. On an end of life interim release, the whole release is out of support regardless of what this prints.

Step 3: Check Ubuntu Pro status

The Ubuntu Pro client basic commands tutorial uses this to show which services are available and whether the machine is attached:

pro status

Ubuntu Pro's ESM covers LTS releases. Attaching an interim release to Pro does not bring back security updates for it, which is why the fix for an interim is an upgrade or a rebuild.

Step 4: Check the user namespace restriction on 23.10 and later

On 23.10 the restriction was off by default; on 24.04 LTS it is on. The setting the 23.10 notes name lives at /proc/sys/kernel/apparmor_restrict_unprivileged_userns, and the persistent configuration is the file /etc/sysctl.d/60-apparmor-namespace.conf. A value of 1 means the restriction is active. Leave it on; the 24.04 notes describe the AppArmor unconfined profile flag with the userns permission as the way to let a specific application use namespaces, rather than turning the restriction off for the whole system.

Step 5: Move to a supported release

Canonical's server guide, How to upgrade your Ubuntu release, sets the rules for supported releases. Bring the system fully up to date first, including phased updates:

sudo apt update
sudo apt dist-upgrade -o APT::Get::Always-Include-Phased-Updates=true

If /run/reboot-required exists, reboot. Back up your data, then run:

sudo do-release-upgrade

The guide warns that third party repositories and PPAs are disabled during the upgrade and are "the most common cause of upgrade issues". Each interim's own notes give the same server procedure: install update-manager-core if needed, make sure the Prompt line in /etc/update-manager/release-upgrades is set to normal, and run sudo do-release-upgrade.

That procedure assumes a supported release. The server guide does not cover end of life releases, and the old wiki page on end of life upgrades returned 404 when we checked. The packages remain on old-releases.ubuntu.com, but for servers and images we recommend rebuilding on 24.04 LTS or 26.04 LTS from releases.ubuntu.com. If you must run an old interim for research, keep it in a virtual machine with no network access; see whether to upgrade, extend, isolate or retire end of life software.

Common mistakes

• Treating an interim as "newer, so safer". 23.10 is newer than 22.04 LTS, but 22.04 is supported until May 2027 and 23.10 ended in July 2024. Version number and support length are unrelated.
• Assuming Ubuntu Pro rescues an interim. ESM is described for LTS releases. There is no paid path that keeps 21.10 or 23.04 patched.
• Reading uname output inside a container as the image's release. The kernel belongs to the host. The image's release is in /etc/os-release.
• Pinning an interim base image "for a newer toolchain". You get the toolchain, and you also get a base system that stops receiving security updates within nine months. Use an LTS base and install the newer toolchain you need on top, through a maintained channel.
• Turning the user namespace restriction off globally. The 23.10 and 24.04 notes both say that disabling it "does not mitigate against kernel exploits that abuse the unprivileged user namespaces feature". Use a per application profile instead.
• Assuming TPM-backed FDE in 23.10 was ready for fleet use. The notes call it experimental, list a limited set of supported hardware, and exclude external kernel modules such as NVIDIA drivers.
• Quoting dates from memory. Release notes, release schedules and announcement posts give different days for 23.04 and 23.10. Say which page you used.

FAQ

Is Ubuntu 23.10 still supported?

No. The 23.10 release notes say it "will be supported for 9 months until July 2024". There is no ESM for interim releases. Upgrade to 24.04 LTS or 26.04 LTS, or rebuild on one of them.

Is Ubuntu 22.10 still supported?

No. Support ended in July 2023, per the 22.10 release notes. 22.04 LTS, which came out six months earlier, is supported until May 2027 on the release cycle page.

What kernel does Ubuntu 23.04 use?

Linux 6.2, per the 23.04 release notes, up from 5.19 in 22.10.

When did Ubuntu make Wayland the default?

In 21.04, "on most configurations". 18.04 LTS had used X by default with Wayland as a technical preview. For LTS users, the 22.04 notes are the first to make Wayland the default session for most systems without an NVIDIA graphics card.

When did Ubuntu drop 32-bit i386?

The 19.10 release notes say "Support for i386 as a host architecture is dropped in 19.10". 18.10 had already blocked i386 users from upgrading, and the 20.04 LTS notes repeat that i386 host support was dropped in 19.10.

Which Ubuntu version introduced TPM-backed full disk encryption?

23.10, as an experimental feature in the desktop installer. It needs TPM 2.0 and supported hardware, and at launch did not support external kernel modules such as NVIDIA drivers. 24.04 LTS carried it forward, still described as experimental.

Why are Ubuntu interim releases only supported for nine months?

They are designed to bring new kernels, toolchains and features every six months, with three months of overlap so users can move to the next release. The release cycle page recommends the LTS for production.

Can I upgrade directly from Ubuntu 18.10 to 24.04?

Not in one step. The server upgrade guide says you cannot skip releases on the LTS path and covers supported releases only, and every release from 18.10 to 23.10 is now end of life. For a server or container image, a rebuild on 24.04 LTS or 26.04 LTS is the practical route.

What does it mean if my Docker base image says "mantic" or "impish"?

The image is built on Ubuntu 23.10 or 21.10, both end of life (July 2024 and July 2022). Its operating system packages have not received security updates since then. Rebuild it on an LTS base such as 24.04 (noble) or 26.04 (resolute).

Fix it without waiting for upstream

An image built on 21.10 or 23.04 is a clear case of waiting forever: the distribution will never ship another fix for those packages. Moving the base image to a supported LTS is the operating system half of the job. The application dependencies you install on top of that base are the other half, and those are yours to update whatever release you run.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

None of these demos changes which Ubuntu release a machine runs, and none of them patches an end of life interim. They show how to find what is inside the images and repositories built on a given release, and how to move the dependencies you control to fixed versions with a person approving each step.

This demo sets up the Safeguard runner on your own machine, approves it with its device code, then scans from the terminal. Scanning a container image produces an SBOM that lists the operating system packages and versions alongside the application components, which is how you find the images whose base still reports an interim release such as 21.10 or 23.04.

Click through it at your own pace, or open it full screen.

In this session you install the Safeguard CLI, run safeguard to open the interactive terminal and ask it to fix the lodash CVE in a repository. It reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, prints a summary and pushes nothing. When you rebuild an old service from a 21.10 base onto 24.04, the same flow handles the application's own outdated dependencies, which a base image change does not touch.

Click through it at your own pace, or open it full screen.

This demo connects Claude to the Safeguard MCP server with OAuth and lets you choose which tools Claude can use. Once connected, you can ask in plain language which of your projects contain a given component and version, the same question our post on using SBOMs to find affected products fast works through.

Click through it at your own pace, or open it full screen.

You can download Safeguard at safeguard.sh/download and read the CLI documentation at docs.safeguard.sh/docs/cli.

Quick check

Sources

• Ubuntu release notes: 18.10
• Ubuntu release notes: 19.04
• Ubuntu release notes: 19.10
• Ubuntu release notes: 20.10
• Ubuntu release notes: 21.04
• Ubuntu release notes: 21.10
• Ubuntu release notes: 22.10
• Ubuntu release notes: 23.04
• Ubuntu release notes: 23.10
• Ubuntu release notes: 18.04 LTS
• Ubuntu release notes: 20.04 LTS
• Ubuntu release notes: 22.04 LTS
• Ubuntu release notes: 24.04 LTS
• Ubuntu: Release cycle
• Ubuntu: Kernel lifecycle and enablement stack
• Ubuntu: Old releases index
• Ubuntu Discourse: Kinetic Kudu release schedule
• Ubuntu Discourse: Lunar Lobster release schedule
• Ubuntu Discourse: Mantic Minotaur release schedule
• Ubuntu Discourse: Ubuntu 23.04 (Lunar Lobster) released
• Ubuntu Discourse: Ubuntu 23.10 (Mantic Minotaur) released
• Ubuntu Discourse: Phased updates in APT in 21.04
• Ubuntu Server documentation: How to upgrade your Ubuntu release
• Ubuntu Pro client documentation: Basic commands
• Ubuntu manpages: lsb_release(1)
• Ubuntu manpages: os-release(5)

Last reviewed: 23 October 2026.