Zephyr states that LTS releases are maintained independently from the main tree for approximately five years. The first two years include general bug fixes and security fixes, and the following period carries security and operating system stability fixes only. Plan device support periods against that schedule, not against hopeful assumptions.
What the release process says
The Zephyr release process documentation describes the support window for an LTS release in phases.
| Phase | Length | Fixes |
|---|---|---|
| 1 | First 2 years | General bug fixes and security fixes, including platform and driver fixes |
| 2 | Following 3 or more years | Security and OS stability fixes only |
| 3 | After that | Extended support may be available through third parties, details to be determined |
A release N stays supported until the initial release of the LTS two versions ahead. The final release of LTS N comes shortly after that.
The page also says fixes for an LTS branch that apply to the mainline tree shall be submitted to mainline as well, and that changes moved from main to an LTS branch are limited to fixes that apply to both branches and for existing features only.
What it means for a device maker
If you ship devices that must receive security updates for ten years, an LTS window of about five years does not cover you on its own. You will either migrate to a newer LTS during the product life or take on maintenance work yourself.
- Write down your promised support period and compare it with the project's window.
- Plan a rebase. Moving a product from one LTS to the next takes testing time, so schedule it before support ends.
- Know your fixes. In the second phase, bug fixes that are not security or stability may not reach your branch.
- Track what you changed. Local patches and out-of-tree modules make every move harder.
Do not forget the modules
An OS release is only part of the image. Libraries, vendor HAL code and application dependencies each have their own support policy. Record those windows next to the OS one, since the shortest window sets your real horizon.
Questions for planning
- Which LTS is each product line on today?
- When does its security window end?
- How many products would have to move at once?
- Who owns the migration work and its test plan?
Where Safeguard fits
If you want an inventory your reviewers can query, Safeguard offers SBOM and dependency scanning with policies and gates on pull requests. It works from the source and manifests it supports. A free scan is at gold.safeguard.sh/scan.
Try it yourself
Follow how a finding moves through states, then picture the same flow for a component whose upstream window has ended.
Click through it at your own pace, or open it full screen.
Quick check
Does LTS mean every bug is fixed?
No. After the first two years the documentation describes security and OS stability fixes only.
Who supports a release after the project stops?
The documentation says extended support may be available through third parties, with details to be determined, so do not count on it without confirming.
Sources
Last reviewed: 19 October 2026.
