SECOND MEASUREMENT SM-023
Canonical says “critical vulnerabilities are released within 24 hours” in Ubuntu. Since June its security team has raised 57 kernel vulnerabilities to critical from a CVSS score; of the 24 fixed after being raised, none was fixed within a week, and the median wait was 16.5 days
The claim: Ubuntu critical vulnerabilities: Canonical says within 24 hours; of 24 kernel CVEs fixed after being raised to critical, none within a week
What we found: 57 kernel CVEs raised from medium to critical on a CVSS score since June 2026; of the 24 fixed after being raised, 0 within a week, median 16.5 days; 0 of 33 within 24 hours. 14 of 51 fixed still open on a supported release.
Status: Published 21 Oct; questions posted 21 Oct on Ubuntu Discourse (moved to its own topic, 89999); no reply yet
Ubuntu’s security team sets each vulnerability’s priority, and Canonical says critical ones are released within 24 hours, across every supported release. We read all 70 vulnerabilities Ubuntu rated critical on 2026-10-20, the commit in the team’s public tracker that made each one critical, and the day its first fix reached users. 57, all Linux kernel, were recorded as medium and raised to critical from a CVSS score between June and October 2026. 23 were already fixed when raised, and one affects no Ubuntu release. None of the other 33 was fixed within a day: 24 were fixed a median 16.5 days later, none within a week, and 9 were still waiting.
- Canonical, in the Ubuntu Pro FAQ, answered by a Canonical staff member: “critical vulnerabilities are released within 24 hours. Then, on average, high CVEs are patched within 30 days, and medium CVEs within 60 days since they are known to the Ubuntu Security Team. This criteria applies to every package affected by the vulnerability, across every Ubuntu release actively supported.”1 The Ubuntu Pro general-availability post: “critical CVEs patched in less than 24 hours on average.”2
- “Critical” is the Ubuntu Security Team’s own priority, which Ubuntu says is “distinct from other published severity levels such as CVSS base scores”.3 We read all 70 vulnerabilities Ubuntu rates critical from its CVE API; from the team’s public tracker,
ubuntu-cve-tracker, the commit that first set each one’sPriority:line to critical; and the first fix that reached users, the earlier of its first security notice (USN) and the day the fixed package was published to the archive.6 - 57 kernel vulnerabilities were raised to critical from a CVSS score. Every one was recorded as medium, and between 9 June and 18 October 2026 a tracker commit raised it to critical with the note “Priority reason: See ubuntu cvss score” and an Ubuntu CVSS v4 score of 9.1 to 9.4, in batches: 17 in June, 12 in July, 9 in August, 3 in September, 16 in October.
- 23 of them were already fixed when they were raised, and one (CVE-2026-43208) affects no Ubuntu release. Of the other 33, none was fixed within 24 hours: 24 were fixed 16.5 days after being raised at the median, none within a week, the longest after 37.3 days; 9 were still waiting when we read them, 2.1 to 4.4 days after being raised.
- The 13 the team rated critical by its own judgement are mostly older. 8 were fixed before the tracker first marked them critical, most of them because they were first entered in the tracker, already critical, after the fix; of the 3 that can be timed, 2 were fixed within a day.
- Across every release: of the 51 critical kernel vulnerabilities with a fix somewhere, 14 still show the main
linuxpackage as needed or pending on a release in standard or Ubuntu Pro support (read 2026-10-20). - On 23 September 2026 Canonical announced a move to a single two-week kernel update cycle and said its aim is “to get environments into a defensible, safer state within 24 to 48 hours of public disclosure – well before a patch ships.”4 The FAQ still says 24 hours for the patch.
Disclosure: Markovian Protocol holds no financial position in Canonical, was paid by no one for this work, and showed it to no one before publication. How we work.
Critical by judgement and critical by CVSS
| How the priority was set | Critical | Fixed | Fixed before rated critical | Timed | Within a day | Within a week | Median wait |
|---|---|---|---|---|---|---|---|
| By the team’s judgement | 13 | 11 | 8 | 3 | 2 | 3 | 0.1 days |
| Raised from medium on a CVSS score | 57 | 47 | 23 | 24 | 0 | 0 | 16.5 days |
Wait = first fix reaching users minus the first commit that set the vulnerability’s Priority: line to critical in ubuntu-cve-tracker. First fix = the earlier of the first USN and the first publication, in the Security, Updates or Release pocket and on or after that release’s own release date, of the fixed version the tracker lists for any release: the main linux package for kernel vulnerabilities, the vulnerability’s own package otherwise (Launchpad publishing history; versions kept in Ubuntu Pro’s private archive cannot be dated and are left out). “Fixed before rated critical” = a negative wait, left out of the timed columns. Livepatch notices (LSNs) exist for 21 of these vulnerabilities; none came before the first fix, so counting them changes nothing. Read at 19:07 UTC on 2026-10-20.
The team-rated ones, all 13:
| CVE | Published | Package | Priority reason | Rated critical to fix |
|---|---|---|---|---|
| CVE-2008-0166 | 2008-05-13 | openssl and 6 more | — | fixed before marked critical |
| CVE-2012-0954 | 2012-06-15 | apt | — | 0 days |
| CVE-2012-3587 | 2012-06-19 | apt | — | fixed before marked critical |
| CVE-2014-0038 | 2014-01-30 | linux and 17 more | — | 0.1 days |
| CVE-2014-0196 | 2014-05-05 | linux and 29 more | — | fixed before marked critical |
| CVE-2015-8768 | 2017-02-13 | click | — | fixed before marked critical |
| CVE-2017-11281 | 2017-12-01 | flashplugin-nonfree | — | fixed before marked critical |
| CVE-2017-11282 | 2017-12-01 | flashplugin-nonfree | — | fixed before marked critical |
| CVE-2017-5754 | 2018-01-03 | linux and 80 more | — | 1.9 days |
| CVE-2011-3374 | 2019-11-26 | apt | — | fixed before marked critical |
| CVE-2024-3094 | 2024-03-29 | xz-utils | Results in a backdoor in sshd | no release affected |
| CVE-2024-35863 | 2024-05-19 | linux and 172 more | Remote SMB server can trigger kernel UAF | fixed before marked critical |
| CVE-2026-4370 | 2026-04-01 | juju | remote data compromise | no release affected |
Other start times
For the 57 raised on a CVSS score, other starts give longer waits, because they include the time each spent at medium, for which the FAQ’s figure is 60 days:
| Clock starts when | Timed | Within a day | Median |
|---|---|---|---|
| the vulnerability was published | 40 | 0 | 47.3 days |
| the team first recorded it (at medium) | 39 | 0 | 45.2 days |
| the team raised it to critical (used above) | 24 | 0 | 16.5 days |
Counting a new release that came out after a vulnerability was raised, already carrying the fix, as a fix on its release date changes nothing: 24 timed, 0 within a day, median 16.5 days. CVE-2026-43208 is left out of every count of waits, since no Ubuntu release carried it.
Every supported release
The FAQ applies the 24 hours “across every Ubuntu release actively supported”. On 2026-10-20, 4 releases are in standard support and 2 more in Ubuntu Pro (ESM): 18.04 LTS (bionic), 20.04 LTS (focal), 22.04 LTS (jammy), 24.04 LTS (noble), 26.04 LTS (resolute), 26.10 (stonking). Of the 51 critical kernel vulnerabilities with a fix somewhere, 14 still show the main linux package as needed or pending on at least one of them:
| Release | Critical kernel fixes still needed or pending |
|---|---|
| 18.04 LTS (bionic) | 6 |
| 20.04 LTS (focal) | 7 |
| 22.04 LTS (jammy) | 7 |
| 24.04 LTS (noble) | 3 |
Only the main linux source package is counted, not the dozens of kernel variants. “Pending” means a fix is prepared but not yet released. 14.04 LTS (trusty), 16.04 LTS (xenial) are now covered only by the paid Legacy add-on, not Ubuntu Pro, and are left out above; on them 6 of the fixed critical kernel vulnerabilities are still open.5
Another 9 critical kernel vulnerabilities had no fix released for the LTS releases that still need them on 2026-10-20, 2.1 to 4.4 days after they were raised to critical. One of them, CVE-2023-53867, is already fixed in the kernels 24.04 and 26.04 LTS shipped with; it is still needed on 18.04, 20.04 and 22.04 LTS.
What Canonical announced in September
Canonical’s post of 23 September 2026 outlined “a transition from its current 4-week regular and 2-week security kernel Stable Release Update (SRU) cycles to a unified, rapid 2-week SRU cycle, published weekly”, with no date given for the change, and said that while a patch is prepared “Canonical aims to provide safe workarounds where applicable”.4 It went on: “Where no safe workaround exists, Canonical will say so clearly and point users toward general hardening steps instead.” Since that post, two vulnerabilities now rated critical were published; both were recorded as medium and raised to critical on 18 October 2026, two days before our read. On 2026-10-20, CVE-2026-93221 had a fix pending for 26.04 LTS and still needed for 20.04, 22.04 and 24.04 LTS; CVE-2026-98365 had fixes pending for 24.04 and 26.04 LTS and still needed for 18.04, 20.04 and 22.04 LTS. 26.10 already ships a kernel containing both fixes. Neither had a USN, the mitigation field on each CVE page was empty, and searching Canonical’s blog, Ubuntu’s security notices and Ubuntu’s Discourse forum for each CVE found neither a workaround nor a statement that none exists (workaround_search_2026-10-20.json). On 2026-10-20, Ubuntu’s web pages for both, and for CVE-2026-89530, still showed “Ubuntu priority Medium” (last updated 8 October, 25 September and 6 October) while Ubuntu’s CVE API and tracker said critical (saved pages: 98365, 93221, 89530).
How this ends
Canonical can close it three ways: ship CVSS-rated critical kernel fixes within 24 hours; stop rating kernel vulnerabilities critical from a CVSS score alone, so that “critical” means what the team judges critical; or change the FAQ to say what kernel users should expect. We recheck monthly and print the table here.
Our questions to the Ubuntu Security Team
- Does the FAQ’s “critical vulnerabilities are released within 24 hours” cover kernel vulnerabilities rated critical from the Ubuntu CVSS score? If not, will the FAQ or the label change?
- Under the two-week kernel cycle announced on 23 September, what should users expect between a CVSS-rated critical kernel vulnerability and its released fix?
- For the 14 critical kernel vulnerabilities fixed in some releases but still needed or pending in others under standard or Pro support, is there a date for the rest?
Their reply, scored
What we told whom, and when.
| 2026-10-20 | Measured. Nobody has seen the page. |
| 21 Oct 2026 | Published. The three questions above posted as a reply in the Ubuntu Pro FAQ thread, in reply to the answer that carries the 24-hour line, where Canonical staff answer. |
| 21 Oct 2026 | A community moderator moved the post into its own topic in the same Ubuntu Pro category, “as this is not a Frequently Asked Question” (saved topic). |
What we can’t be sure of
- The FAQ line was written on 29 March 2023 by a Canonical staff member answering a question on Ubuntu’s forum; the general-availability post is from January 2023; and a 24-hour line was in Canonical’s CVE-prioritisation post by March 2020. Canonical may treat the September 2026 post as its current statement for the kernel. All three earlier pages are still live.
- The critical date is the first commit that set the vulnerability’s
Priority:line to critical in the public tracker; the CVSS v4 score is the one that commit added (“ubuntu: CVSS:4.0 … [9.x CRITICAL]”). The team may decide on a priority before pushing the commit, which would make the waits longer. On each commit’s author date instead of its push date, 24 can be timed, 0 within a week, median 19.1 days. - The fix date is the first fix on any release. The FAQ promises every supported release, so the wait until all of them are fixed is at least this long.
- Fixes uploaded to a release while it was still in development are not counted, nor are fixes sitting in
-proposed, which users get only if they opt in. 26.10 had some of these fixes during its development, before it was released on 15 October 2026. - Fixed versions published only to Ubuntu Pro’s private archive have no public date; a vulnerability fixed there first and nowhere public would read later here than it was.
- 3 critical vulnerabilities (CVE-2024-3094, CVE-2026-43208, CVE-2026-4370) have no fix and no release that needs one; they are in the total but not counted as waiting.
Run it yourself
git clone --filter=blob:none --no-checkout https://git.launchpad.net/ubuntu-cve-tracker uct python3 known_dates.py exhibits/rows_2026-10-20.json uct known.json python3 crit_dates.py exhibits/ubuntu_critical_cves_raw_2026-10-20.json uct crit.json python3 fix_dates.py exhibits/ubuntu_critical_cves_raw_2026-10-20.json exhibits/ubuntu_releases_2026-10-20.json fixes.json python3 analyze.py exhibits/ubuntu_critical_cves_raw_2026-10-20.json known.json crit.json exhibits/ubuntu_releases_2026-10-20.json uct fixes.json summary.json # a fresh read of the live API instead of the saved one: python3 census.py raw_new.json rows_new.json
Needs Python 3 and git; Ubuntu’s CVE API and Launchpad’s are anonymous. The tracker clone takes a few minutes; known_dates.py about two, crit_dates.py about 35, since it fetches each file’s history. Scripts and exhibits: sm-023/.
References
- Ubuntu Discourse, Ubuntu Pro FAQ, reply 23 by Maria Emilia Torino (Canonical), written 29 March 2023. discourse.ubuntu.com, saved copies ubuntu_pro_faq_raw_2026-10-20.md, discourse_ubuntu_pro_faq_post23_2026-10-20.json and its edit history.
- Ubuntu blog, Ubuntu Pro enters general availability, 26 January 2023. ubuntu.com, saved copy ubuntu-pro-enters-ga_2026-10-20.html. Also Alex Murray, Securing open source through CVE prioritisation, 26 March 2020: “the most vital updates are prepared, tested and released within 24 hours”, saved copy securing-open-source-through-cve-prioritisation_2026-10-20.html and the Internet Archive copy of 28 March 2020, wayback_cve_prioritisation_20200328.html; the live page now carries a 20 July 2023 date.
- Ubuntu, About CVEs: priority levels. ubuntu.com, saved copy security_cves_about_2026-10-20.html.
- Canonical blog, Accelerating delivery of CVE fixes with a new Kernel release strategy, 23 September 2026. canonical.com, saved copy canonical_blog_kernel_release_strategy_2026-10-20.html.
- Ubuntu, Expanded Security Maintenance (support schedule). ubuntu.com, saved copy security_esm_2026-10-20.html.
- Ubuntu CVE API,
ubuntu.com/security/cves.json?priority=critical(saved: ubuntu_critical_cves_raw_2026-10-20.json);ubuntu.com/security/releases.json; Launchpad publishing history (api.launchpad.net, saved as fixes_2026-10-20.json); ubuntu-cve-tracker git history (priority changes saved as crit_2026-10-20.json).