Canonical has announced a transition to a unified two-week preparation cycle for Linux kernel package updates, with a new update being released each week. The update development cycle has been shortened due to the increasing intensity of vulnerability discovery in the Linux kernel. The new cycle for generating the next corrective package update will now kick off every week without distinguishing between regular updates and security fixes.
Delivering each security update to users will take two weeks — one week for preparation, building, and basic testing of the package, and the second week for extended testing, regression identification, and certification. Thus, new versions of kernel packages will now be released once a week, and the maximum delay in addressing critical vulnerabilities will not exceed two weeks.
For users who wish to install security patches as soon as possible and are ready to use packages that have not completed all testing phases, preliminary updates will be available in the 'proposed' repository a week early. Additionally, within 24-48 hours of public awareness of a vulnerability, Canonical will publish possible workarounds to mitigate the vulnerability, and if no workarounds are available, it will recommend general security enhancement measures.
Previously, a combined scheme was utilized where regular package updates were published every four weeks, and then two weeks after the start of the cycle for generating the next regular update, a separate update was released that included fixes for only critical vulnerabilities and important issues. Preparation and testing of standard updates before publication took four weeks, while intermediate updates addressing vulnerabilities took two weeks.
Source: opennet.ru
