Ubuntu 24.10 to 26.10: Oracular Oriole to Stonking Stingray

Ubuntu shipped four interim releases between the 24.04 and 26.04 LTS releases and just after them: 24.10 "Oracular Oriole" (10 October 2024, kernel 6.11, GNOME 47, supported to July 2025), 25.04 "Plucky Puffin" (17 April 2025, kernel 6.14, GNOME 48, to January 2026), 25.10 "Questing Quokka" (9 October 2025, kernel 6.17, GNOME 49, to July 2026) and 26.10 "Stonking Stingray" (15 October 2026, kernel 7.3, GNOME 51, to July 2027). Only 26.10 is still supported today.

These four releases are where most of the security changes in 26.04 LTS were tried first: sudo-rs, the Rust core utilities, APT 3 without apt-key, AppArmor's tighter user namespace rules, network time security and TPM-backed disk encryption with a passphrase. 26.10 then goes further, with fully Rust coreutils, OpenSSL 4, a split OpenSSH package and TPM encryption on machines without a hardware root of trust. This post lists the facts of each release with a citation, explains what changed from one to the next, and ends with a walkthrough using only commands from Canonical's documentation. It sits in our series on every Ubuntu release, next to the Ubuntu 26.04 LTS post.

Key takeaways

• Four releases, four kernels: 6.11 (24.10), 6.14 (25.04), 6.17 (25.10, images based on 6.17-rc7) and 7.3 (26.10, images based on 7.3-rc6).
• Desktop: GNOME 47, 48, 49 and 51. From 25.10 the Ubuntu Desktop session runs only on Wayland; the X.org session is gone.
• Support: every interim release gets 9 months. 24.10 ended July 2025, 25.04 ended January 2026, 25.10 ended July 2026, and 26.10 runs to July 2027. Expanded Security Maintenance does not apply to interim releases.
• 25.10 made sudo-rs the default sudo and moved the core utilities to rust-coreutils, keeping GNU cp, mv and rm until 26.10 migrated those too.
• 25.04 removed apt-key with APT 3.0; signature checks call gpgv directly. 26.10 adds the Rust-based Sequoia PGP to main, with gpg still available.
• AppArmor tightened in 25.04: many new profiles, a dedicated profile for bwrap, and removal of the busybox and nautilus profiles that allowed unprivileged user namespaces.
• TPM-backed full disk encryption gained passphrase support and recovery key management in 25.10, and in 26.10 it is allowed on machines without a hardware root of trust when a PIN or passphrase is set (already backported to 26.04.1).
• 26.10 security changes: OpenSSL 4, OpenSSH split into GSSAPI and non-GSSAPI packages with the non-GSSAPI one installed by default, ssl-cert default key length raised from 2048 to 3072 bits, and SPDX SBOMs shipped for the amd64 and arm64 kernels.
• ufw is still installed and off by default. None of the four release notes changes that.

What are the facts for each release?

Sources for each row: the per-release notes for 24.10, 25.04, 25.10 and 26.10; the release schedule pages for 24.10, 25.04, 25.10 and 26.10; the release announcements on Ubuntu Discourse for 24.10, 25.04, 25.10 and 26.10; and the release cycle page.

Only the 26.10 notes state the release day in the text. For the other three, the dates come from the "Final Release" row of each schedule page and match the release team's announcements on Discourse.

The release cycle page lists 26.10 with "Released: Oct 2026", standard security maintenance to "Jul 2027", and "Not applicable" for Expanded Security Maintenance, break/bug support and the Legacy add-on. It no longer lists 24.10, 25.04 or 25.10 at all, which is consistent with all three being past their end dates. The same page lists 26.10's architectures as amd64, armhf, arm64, s390x, riscv64 and ppc64el-p9.

Why do interim releases only get 9 months?

Canonical describes the trade-off on the release cycle page: interim releases "provide cutting-edge features and hardware support every six months, but with only 9 months of updates," and production environments "should use the LTS version." The Ubuntu Server upgrade guide says the same thing from the operator's side: LTS releases get 5 years of standard support, "whereas interim releases are only supported for nine months."

Nine months is six months until the next release plus three months of overlap to upgrade. In practice that means an interim install has to move every six to nine months or it stops receiving security updates. There is no paid extension: Ubuntu Pro's Expanded Security Maintenance applies to LTS releases, and the release cycle page marks it "Not applicable" for 26.10.

This matters most for container images. A base image pinned to an interim tag is fine while that release is supported, but the day it goes end of life the image stops getting USNs, and nothing in the build will tell you. 24.10, 25.04 and 25.10 images still exist in registries and caches. Our guide on how to check whether a base image OS is end of life shows how to find them, and upgrade, extend, isolate or retire covers what to do next. For the full lifecycle model, see our post on the Ubuntu release support lifecycle.

Where the interim kernels went

The interim kernels also become hardware enablement (HWE) kernels for the LTS. The kernel lifecycle page lists kernel 6.17 as both 25.10 and the 24.04.4 LTS HWE kernel (released January 2026, standard support to July 2026), kernel 7.0 as 26.04.0 and the 24.04.5 LTS HWE kernel (July 2026), and kernel 7.3 as 26.10. The 6.11 and 6.14 kernels are not listed on that page as of 23 October 2026, so we do not state which 24.04 point releases carried them. The same page notes that 24.04 desktop installs track the HWE stack by default while server installs default to the GA kernel.

Ubuntu 24.10 "Oracular Oriole": what shipped?

Ubuntu 24.10 was announced on 10 October 2024. The announcement says it ships Linux 6.11, "marking a shift to a more aggressive kernel version selection policy going forward," and GNOME 47. The 24.10 notes, which also mark 20 years since 4.10 "Warty Warthog", say 24.10 "will be supported for 9 months until July 2025."

Desktop and kernel

• GNOME 47, with Ubuntu patches to GNOME Shell and Mutter not yet merged upstream.
• Wayland on NVIDIA by default. The notes say 24.10 "now defaults to Wayland instead of Xorg on machines using Nvidia graphics," with "Ubuntu on Xorg" still selectable at the login screen.
• Crash dumps on by default. Kernel crash dumps "are now enabled by default for desktop and server installations." The Ubuntu Server kernel crash dump guide confirms kdump is enabled by default during standard installs.

Security relevant changes in 24.10

• Security Center and permissions prompting. A new Security Center app can turn on an "experimental permissions prompting feature for Home directory permissions," backed by a seeded prompting-client snap. This applies to snaps asking for access to your home directory.
• OpenSSL 3.3, which now loads configuration drop-ins from /etc/ssl/openssl.conf.d.
• systemd 256.5. cgroup v1 is "considered obsolete and systemd by default will refuse to boot under it." System V service scripts are deprecated. /tmp is now a tmpfs by default because Ubuntu ships upstream's tmp.mount. A new systemd-ssh-generator can bind a socket-activated SSH server to local AF_VSOCK and AF_UNIX sockets when sshd is installed.
• DNS search domains. systemd-networkd no longer sets UseDomains=true, so search domains from DHCP leases are no longer written to /etc/resolv.conf by default. (25.04 restored it for cloud images.)
• OpenSSH no longer reads ~/.pam_environment. The user_readenv=1 parameter was removed from the sshd PAM stack because Linux-PAM deprecated it "due to security concerns." Locale variables still pass through AcceptEnv and SendEnv.
• Container AppArmor templates. containerd 1.7.19 and Docker 26.1.3 updated their AppArmor templates so confined runc can stop containers. The known issues section still lists a bug where containers are killed with SIGKILL because of AppArmor denials.
• TPM-backed full disk encryption appears only in known issues: it is incompatible with Absolute (formerly Computrace) firmware software, and its kernel snap may lack modules such as vmd for NVMe RAID.

Ubuntu 25.04 "Plucky Puffin": what shipped?

Ubuntu 25.04 was announced on 17 April 2025 with GNOME 48 and Linux 6.14. The 25.04 notes say it "will be supported for 9 months until January 2026," and that upgrades to 25.04 were "temporarily suspended" at release because of two release upgrader bugs (Qt dependency handling and removal of foreign packages from disabled sources). The AWS announcement on Discourse says the release "includes important configuration changes to strengthen baseline security" and asks users to report AppArmor denials.

Desktop and kernel

• GNOME 48, including the triple buffering feature contributed from Ubuntu. Papers replaces Evince as the PDF viewer.
• Linux 6.14, with the sched_ext scheduler framework and the NTSYNC driver. The linux-lowlatency package was retired in favour of linux-generic plus a lowlatency-kernel tuning package.
• Installer: install alongside BitLocker-protected Windows partitions, and encrypted installs offered for dual boot.

Security relevant changes in 25.04

• AppArmor profile writing effort. The AppArmor package "now includes many new profiles for applications," which "can help mitigate the impact of any exploit in the confined applications," with the warning that unexpected uses may break.
• A bwrap profile. bwrap-userns-restrict lets bubblewrap create user namespaces for sandboxing, then moves the sandboxed processes to a tighter profile that denies capabilities.
• Profiles removed for user namespace hardening. The busybox and nautilus profiles that allowed user namespaces directly were removed, so "the busybox unshare function can no longer be used to create unprivileged user namespaces." Canonical's explainer on the user namespace restriction describes it as attack surface reduction: it "does not stop kernel exploits directly" but limits user namespaces to applications that have a legitimate need. We link the explainer for background only.
• APT 3.0. "The apt-key command has been removed. Signature verification now makes direct use of gpgv." APT also moved from GnuTLS and gcrypt to OpenSSL for TLS and hashing. Old repository setup scripts that call apt-key add fail from 25.04 on. Our post on Linux distribution package signing explains how archive keys work.
• OpenSSL 3.4.1 and GnuTLS 3.8.9, with patches from their stable branches.
• Network Time Security in chrony. From chrony 4.5-3ubuntu4 the package ships "a default configuration set to use Ubuntu NTS servers." NTS key exchange uses 4460/tcp; a new CA in /etc/chrony/nts-bootstrap-ubuntu.crt serves the bootstrap server. If those ports are blocked, chrony cannot set the clock.
• runc fix for CVE-2024-45310, which the notes describe as "a low-severity attack that allowed maliciously configured containers to create empty files and directories on the host."

Ubuntu 25.10 "Questing Quokka": Rust sudo and coreutils by default

Ubuntu 25.10 was announced on 9 October 2025. The announcement says it "debuts Rust-based implementations of sudo and coreutils for improved memory safety," which confirms the topic's question: yes, both became defaults in 25.10. The 25.10 notes say it "will be supported for 9 months until July 2026" and that upgrades were "expected to be enabled on or before Nov 3," with two rust-coreutils bugs listed as blockers.

sudo-rs becomes the default sudo

The notes say: "sudo-rs is the default sudo provider on Ubuntu from 25.10 onwards." The 0.2.8 release added sudoedit, NOEXEC, AppArmor profile switching and support for kernels older than 5.9. The original sudo stayed in the archive at 1.9.17p2, with its binaries "renamed with the .ws suffix," and the sudo-ldap package was removed; LDAP users should authenticate through PAM instead. The notes point to the Ubuntu Server docs for switching the default provider.

rust-coreutils replaces GNU coreutils

"The core utilities of the operating system are now provided by the rust-coreutils package," at version 0.2.2. Because they "are not necessarily fully compatible yet," the GNU utilities remain installed alongside so you can switch back. The 26.04 summary for LTS users, which marks this section "Added in version 25.10," explains that GNU commands are available with a gnu prefix (for example gnuls) and gives the switch commands shown in the walkthrough below. It also says that "because of unresolved bugs, the cp, mv, and rm utilities are still from GNU" in 26.04.

Memory safety removes classes of bugs, not every bug. Our 26.04 post covers known rust-coreutils CVEs and how to read their status in the Ubuntu CVE tracker.

Other security relevant changes in 25.10

• TPM-backed disk encryption gained "passphrase support and management," "regeneration of the recovery key" and "better integration with firmware updates." The Security Center can now manage the recovery key.
• Wayland only. "The Ubuntu on X.org session is no longer available because GNOME Shell can no longer run as an X.org session."
• OpenSSL 3.5.3 (including security patches from 3.5.4) with post-quantum algorithms ML-KEM, ML-DSA and SLH-DSA; "the default TLS supported groups list has been changed to include and prefer Hybrid PQC KEM groups."
• OpenSSH 10.0, which "now uses a hybrid post-quantum algorithm by default for key agreement" and removes the DSA signature algorithm. One side effect is in the known issues: a cloud console's browser SSH feature stopped working because it relied on deprecated key exchange algorithms.
• chrony as the default time daemon with NTS, replacing systemd-timesyncd on new installs. The notes give a migration command for upgraded systems.
• APT 3.1. The new solver is the default; apt why and apt why-not explain solver decisions; repositories accept Include and Exclude directives.
• cloud-init 25.3 fixed CVE-2024-11584 (the hotplug socket is now only root-writable) and CVE-2024-6174, which disables cloud-init on non-x86 platforms that do not declare a known datasource in early boot. The notes warn this may block SSH into launched VMs for some image builders.

Known issues included a flatpak failure caused by missing AppArmor rules for fusermount3, and an AppArmor issue inside LXD containers. On toolchains, the notes say Go "is updated to 1.24" while the announcement lists "Go 1.25"; we could not reconcile the two from official pages.

Ubuntu 26.10 "Stonking Stingray": what is new after 26.04 LTS?

Ubuntu 26.10 is the current interim release. The 26.10 notes say it "was released on 15 October 2026. It will be supported for 9 months, until July 2027." The kernel is Linux 7.3; because the final upstream 7.3 release lands after GA, "the kernel in the release images (7.3.0-9.9) is based on 7.3-rc6." The desktop is GNOME 51. The release announcement summarises the security story as "full adoption of Rust-based coreutils, post-quantum-ready package signing, and expanded TPM-backed full-disk encryption support."

TPM-backed FDE without a hardware root of trust

The notes say: "Computers without a hardware root of trust can now be installed with TPM-backed full disk encryption (FDE), provided that a PIN or passphrase is also set on the TPM-backed key. This was already backported in Ubuntu Desktop 26.04.1."

The hardware-backed disk encryption requirements page explains why the PIN is required. With a hardware root of trust, "your hardware verifies the UEFI firmware before the firmware runs," which protects against firmware malware and tampering in transit; PCs made since 2021 generally have one. Without it, "the Ubuntu installer makes it mandatory to add a PIN or passphrase." You can remove the PIN afterwards, but then the system is not protected against those threats. Our advice: keep the PIN.

Two cautions from the 26.10 notes. First, systems running TPM-backed FDE "will not be able to upgrade from Ubuntu 26.04 LTS to Ubuntu 26.10 on release"; Canonical expects to enable that during the 26.10 cycle. Second, a known issue says running update-grub after conventional GRUB customisations on a TPM/FDE system "might leave your system unable to boot," because snapd manages the boot configuration. The Subiquity 26.10 installer adds an accepted-errors autoinstall directive for TPM/FDE and "New /boot storage requirements in preparation for signed GRUB."

ssl-cert default key length raised to 3072 bits

ssl-cert generates the "snakeoil" self-signed certificate and key that Apache, Postfix and Dovecot use out of the box. Version 1.2.0 in 26.10 "increased the default generated key length from 2048 to 3072 bits, while leaving existing 2048-bit keys untouched." The second half matters: an upgraded server keeps its old 2048-bit snakeoil key until you regenerate it. Snakeoil certificates are for bootstrapping, not public endpoints, so the real fix is a proper certificate.

100% Rust coreutils

"The default core utilities now run entirely on the Rust-based uutils implementation. The remaining GNU utilities (cp, mv, and rm), previously retained due to compatibility issues, have now been migrated." The switch commands from the 26.04 summary still apply.

OpenSSL 4 and the end of engines

26.10 ships OpenSSL 4, which brings Encrypted Client Hello, more QUIC support and further post-quantum work, with fixes through 4.0.3. OpenSSL 4 "no longer supports engines," so libengine-pkcs11-openssl now ships only the PKCS#11 provider and "configurations still referencing the pkcs11 engine need to be migrated to the provider." Apache, PHP, squid and sssd were rebuilt against OpenSSL 4.

OpenSSH split into two packages

OpenSSH is now built from two sources: openssh (no GSSAPI or Kerberos) and openssh-gssapi. The notes say the split "was done to reduce the security exposure of the OpenSSH server and client binaries, as GSSAPI/Kerberos support is not required for many users." Fresh 26.10 installs "default to the non-GSSAPI/Kerberos versions"; the release upgrader detects Kerberos use and picks the GSSAPI packages where needed. Both are at OpenSSH 10.5.

A known issue to respect: when you switch between the two variants, the removed package stays in the "rc" state, and purging it "will break the openssh configuration" and remote access "may be lost." Do not purge an rc openssh package until the fix for LP: #2169738 ships for openssh.

Sequoia PGP and package signing

26.10 "adopts the Rust-based Sequoia PGP into the main archive," with the goal of making it Ubuntu's default OpenPGP toolchain (sq and sqv as counterparts to gpg and gpgv). gpg and gpgv "are still available in the main repository as of Ubuntu 26.10." The announcement's phrase "post-quantum-ready package signing" is not explained further in the 26.10 release notes, so we do not describe how archive signing changed.

Kernel SBOMs

For supply chain work, this is the most useful line in the notes: "The amd64 and arm64 kernels now ship SPDX Software Bills of Materials (SBOM)." The linux-buildinfo-* package for each kernel installs sbom-source.spdx.json.zst, sbom-build.spdx.json.zst and sbom-output.spdx.json.zst under /usr/lib/linux/<version>-<flavour>/. That gives you a vendor-published component list for the kernel itself, alongside the package list you already get from APT.

Other security relevant changes in 26.10

• WEP removed from Settings. GNOME 51 no longer connects to WEP Wi-Fi from the Settings app.
• System V generator removed. systemd-sysv-generator is gone; archive packages that relied on it now ship systemd units or were removed. Local /etc/init.d scripts will no longer start.
• libvirt encrypts its secrets (existing ones stay unencrypted until changed) and drops group-based socket access in favour of polkit.
• php-fpm: the systemd unit was aligned with upstream hardening, and PrivateTmp=true was removed from it. Check this if you relied on a private /tmp for PHP workers.
• MySQL 9.7 LTS removes mysql_native_password; the release upgrader blocks the upgrade until accounts are migrated.

Fixed CVEs called out in the 26.10 notes

The notes list specific fixes in packages that moved forward: Apache 2.4.68 ("around 25 CVEs" across 2.4.67 and 2.4.68), squid 7.7 (nine upstream advisories), strongSwan 6.0.6 and 6.0.7 (CVE-2026-35328 to CVE-2026-35334 and CVE-2026-47895), Exim 4.99.2 to 4.99.4 (CVE-2026-40684 to CVE-2026-40687, CVE-2026-45185 and CVE-2026-48840), PHP 8.5.9 and two sssd fixes.

One example is worth reading closely because it touches Ubuntu Pro itself. The Ubuntu CVE tracker entry for CVE-2026-102371 describes a flaw in wsl-pro-service "before 0.1.19ubuntu3," where the service attached a WSL instance to Ubuntu Pro by passing the Pro token on the command line. Because WSL mounts /proc without process hiding by default, a local unprivileged user in the same instance could read the token while the attach ran, and the token could then attach other machines to the subscription. Ubuntu rates it Medium priority with a CVSS 4.0 base score of 5.7. When we fetched the page on 23 October 2026 it listed fixed versions for 26.04 LTS (0.1.19ubuntu2.1), 24.04 LTS (0.1.1824.04.4), 22.04 LTS (0.1.1822.04.3) and 20.04 LTS (0.1.18~20.04.2+esm1, through ESM Apps). The default status table did not show a 26.10 row; the 26.10 release notes say the fix is in "Stonking Stingray as well." To confirm you have it, compare the installed wsl-pro-service version with the fixed version for your release, and rotate the Pro token if an untrusted user had access to the instance.

What changed from release to release?

Sources: the 24.10, 25.04, 25.10 and 26.10 release notes and 26.04 changes since 25.10. "Not stated" means the release notes for that step do not mention a change.

What are the security defaults on each release?

The ufw row comes from the Ubuntu Server firewall guide, which says "ufw by default is initially disabled," and none of the four release notes changes it. For a laptop setup, see ufw on an Ubuntu developer laptop. For AppArmor modes, see complain or enforce on Ubuntu dev machines. For update behaviour, see what phased updates are and unattended-upgrades settings.

Which of these changes landed in 26.04 LTS, and which are new after it?

26.04 LTS was built on top of 25.10, so most of what the three earlier interims introduced is in the LTS. The 26.04 changes since 25.10 page and the summary for LTS users let you place each one.

26.04 also added items that did not appear in the interims before it: NX enabled in all OVMF Secure Boot variants, sandboxed image loading with glycin, opt-in cargo-auditable metadata for Rust packages built on Launchpad, Livepatch on ARM64, and the real-time kernel in main. Those are covered in the 26.04 post.

Who should run 26.10, and who should stay on 26.04 LTS?

Run 26.10 if you need something it has and 26.04 does not: kernel 7.3 hardware support (new Snapdragon X2 Elite laptops, AMD Zen 6 client enablement, the SpacemiT K3 and SiFive BigSky RISC-V platforms), GNOME 51, OpenSSL 4 features such as Encrypted Client Hello, the 100% Rust coreutils, or MySQL 9.7. Developers who want to test their software against what will likely become 28.04 LTS also benefit. Accept that you must upgrade to 27.04 within nine months, and that there is no ESM to fall back on.

Stay on 26.04 LTS for servers, container base images, anything under a compliance regime, and any machine you will not touch every six months. 26.04 has standard support to May 2031 on the release cycle page, with ESM and the Legacy add-on beyond that. Stay on 26.04 for now if your machine uses TPM-backed FDE (the upgrade path to 26.10 is blocked at release), if you depend on the OpenSSL PKCS#11 engine, or if you have local System V init scripts.

If you are on 24.10, 25.04 or 25.10 today, you are on an unsupported release. Anyone on 25.10 should already be on 26.04; the switch guide says you can move to the LTS track when you are "using an interim release that directly precedes an LTS release, such as on Ubuntu 25.10 before Ubuntu 26.04 LTS." Our post on whether to adopt a new LTS right away covers the general trade-off.

How do you check and move between these releases?

These steps use only commands from Canonical's documentation. Read state first; change nothing until you have checked.

Step 1: Confirm which release you are on

From the Desktop guide to switching between LTS and interim releases:

lsb_release --description
# Description: Ubuntu 26.04 LTS

If this prints 24.10, 25.04 or 25.10, the machine is past its support end date.

Step 2: Check the kernel and its support status

The NVIDIA driver guide uses uname -r to identify the running kernel, and the kernel lifecycle page gives the HWE support check:

uname -r
hwe-support-status --verbose

On 26.10 amd64 and arm64, the kernel SBOM files live under /usr/lib/linux/ in a directory named after the kernel version and flavour, once the matching linux-buildinfo package is installed.

Step 3: Check security coverage

The Pro Client docs explain pro security-status, which reports whether the machine "is receiving security patching" and counts packages that are "no longer available for download":

pro security-status

On an end-of-life interim release, expect it to tell you the machine is not receiving security patches.

Step 4: Check the firewall

From the Ubuntu Server firewall guide:

sudo ufw status verbose
sudo ufw allow 22
sudo ufw enable

Allow SSH first on a remote machine so you do not lock yourself out.

Step 5: Choose the LTS or interim track

The switch guide says to edit /etc/update-manager/release-upgrades and set Prompt=lts to stay on LTS releases, or Prompt=normal to follow interim releases. On Desktop the same choice is in Software & Updates, Updates tab, "Notify me of a new Ubuntu version."

# /etc/update-manager/release-upgrades
Prompt=lts

Step 6: Upgrade

The Ubuntu Server upgrade guide says to bring the system fully up to date, including phased updates, check /run/reboot-required, then run the upgrader:

sudo apt update
sudo apt dist-upgrade -o APT::Get::Always-Include-Phased-Updates=true
sudo do-release-upgrade

The 26.10 announcement says 26.04 users "will be offered an automatic upgrade to 26.10 if they have selected to be notified of all releases rather than just LTS upgrades." Before you upgrade from 26.04 to 26.10, check the blockers in the notes: TPM-backed FDE systems cannot upgrade at release, MySQL accounts on mysql_native_password block the upgrader, and a dangling /lib32 symlink may stop the upgrade while installing base-files.

Step 7: Optional, switch between Rust and GNU coreutils

From the 26.04 summary for LTS users, which the 26.10 notes reference:

# Switch to GNU coreutils
sudo apt install coreutils-from-gnu coreutils-from-uutils- --allow-remove-essential
# Switch back to rust-coreutils
sudo apt install coreutils-from-uutils coreutils-from-gnu- --allow-remove-essential

Common mistakes

• Treating an interim like an LTS. Interim releases get 9 months and no ESM. A server left on 25.10 stopped receiving updates in July 2026.
• Pinning container base images to interim tags. The tag keeps working after end of life; the security updates stop. Rebuild on 26.04 or follow each new interim deliberately.
• Keeping apt-key in provisioning scripts. It was removed in 25.04 with APT 3.0. Use keyrings as described in apt-secure(8).
• Assuming rust-coreutils behaves exactly like GNU. Canonical says it is "not fully compatible yet." Test scripts, and know the switch command.
• Purging an openssh package in the "rc" state on 26.10. The notes warn this can break the counterpart package and cut remote access.
• Running update-grub with custom GRUB settings on TPM/FDE. On 26.10 this "might leave your system unable to boot."
• Removing the TPM PIN on a machine without a hardware root of trust. The installer requires it for a reason.
• Assuming ufw is on. It is installed and off on all four releases.

FAQ

Is Ubuntu 25.10 still supported?

No. The 25.10 release notes say it "will be supported for 9 months until July 2026." Upgrade to 26.04 LTS, which the switch guide describes as the natural LTS step from 25.10.

Is Ubuntu 24.10 end of life?

Yes. The 24.10 notes give support "until July 2025." The release cycle page no longer lists it.

When does Ubuntu 25.04 reach end of life?

It already has. The 25.04 notes say support ran "until January 2026."

What kernel does Ubuntu 26.10 use?

Linux 7.3. The release images carry 7.3.0-9.9, based on 7.3-rc6, because upstream 7.3 was released after GA. The release cycle page and kernel lifecycle page both list 7.3 for 26.10.

How long is Ubuntu 26.10 supported?

Nine months, until July 2027. Expanded Security Maintenance, break/bug support and the Legacy add-on are "Not applicable."

Does Ubuntu 25.10 use sudo-rs?

Yes. "sudo-rs is the default sudo provider on Ubuntu from 25.10 onwards." The original sudo is still available with binaries renamed with a .ws suffix.

Does Ubuntu 26.10 use Rust coreutils for everything?

Yes. The 26.10 notes say the default core utilities "now run entirely on the Rust-based uutils implementation," including cp, mv and rm, which stayed GNU in 25.10 and 26.04.

Can I use TPM disk encryption without a hardware root of trust?

On 26.10, and on 26.04.1 through a backport, yes, if a PIN or passphrase is set on the TPM-backed key. Without the PIN, the system is not protected against firmware threats.

Can I upgrade from 26.04 LTS to 26.10?

Yes, if you set Prompt=normal. Machines using TPM-backed FDE cannot upgrade at release, and MySQL accounts still on mysql_native_password block the upgrader until migrated.

Fix it without waiting for upstream

An interim release that has reached end of life stops getting USNs, but the packages on it and the application dependencies in images built from it keep their vulnerabilities. Moving the OS to 26.04 or 26.10 is the first fix; the second is making sure the libraries your own code ships are on fixed versions, whichever base you rebuild on.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

Safeguard scans repositories, container images and SBOM files and matches the components it finds against vulnerability databases. For this topic, that means an image built on an Ubuntu interim base shows which OS packages and versions it carries next to your application dependencies, so an image still on 25.04 or 25.10 is visible rather than forgotten:

safeguard scan --dir .
safeguard scan --image your-image:tag
safeguard scan --sbom sbom.json

Results are written as JSON under ./output, and the platform shows every project that contains a given component and version. Safeguard does not patch the host kernel or the Ubuntu archive; that stays with Canonical's updates and your upgrade to a supported release.

In this Safeguard CLI session you install the CLI, run safeguard to open the interactive terminal and ask it to fix the lodash CVE in a repository. It reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, prints a summary and pushes nothing. When you rebuild a service from an end-of-life interim base onto 26.04, this is how you bring its own dependencies to fixed versions in the same change.

Click through it at your own pace, or open it full screen.

This demo sets up the Safeguard runner on your own machine, approves it with its device code, then scans from the terminal. A 26.04 or 26.10 build host is a natural place for it, so images built on those bases are scanned locally before they ship. Our guide to how the local runner and offline mode work covers the details.

Click through it at your own pace, or open it full screen.

This demo connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use. Once connected, you can ask Claude which of your projects still carry a component version you are tracking, for example while you work out which images were built on an interim release that has since gone end of life.

Click through it at your own pace, or open it full screen.

To try it yourself, download Safeguard from safeguard.sh/download and follow the CLI docs. For advisories on the OS side, see how to subscribe to Ubuntu and Debian security advisories and how to check for a distro backported fix.

Quick check

Sources

• Ubuntu release notes: Ubuntu 24.10
• Ubuntu release notes: Ubuntu 25.04
• Ubuntu release notes: Ubuntu 25.10
• Ubuntu release notes: Ubuntu 26.10
• Ubuntu release notes: index
• Ubuntu release notes: 24.10 release schedule
• Ubuntu release notes: 25.04 release schedule
• Ubuntu release notes: 25.10 release schedule
• Ubuntu release notes: 26.10 release schedule
• Ubuntu release notes: 26.04 LTS changes since 25.10
• Ubuntu release notes: 26.04 LTS summary for LTS users
• Ubuntu Discourse: Ubuntu 24.10 (Oracular Oriole) released
• Ubuntu Discourse: Ubuntu 25.04 (Plucky Puffin) released
• Ubuntu Discourse: Ubuntu 25.04 Plucky Puffin available on AWS
• Ubuntu Discourse: Ubuntu 25.10 (Questing Quokka) released
• Ubuntu Discourse: Ubuntu 26.10 (Stonking Stingray) released
• Ubuntu Discourse: Understanding AppArmor user namespace restriction
• Ubuntu: Release cycle
• Ubuntu: Kernel lifecycle and enablement stack
• Ubuntu CVE tracker: CVE-2026-102371
• Ubuntu Desktop documentation: Switch between an LTS and interim release
• Ubuntu Desktop documentation: Hardware-backed disk encryption requirements
• Ubuntu Desktop documentation: Install NVIDIA drivers
• Ubuntu Server documentation: How to upgrade your Ubuntu release
• Ubuntu Server documentation: Firewalls
• Ubuntu Server documentation: Kernel crash dump
• Ubuntu Pro Client documentation: What does security-status do?

Last reviewed: 23 October 2026.