Ubuntu 26.04 LTS: Linux 7.0, Virtualization, Security and More
Ubuntu 26.04 LTS, codenamed Resolute Raccoon, represents one of Canonical’s most significant infrastructure-focused releases in recent years. The new long-term support version upgrades the default kernel to Linux 7.0, introduces a new Hardware Enablement virtualization model, expands confidential-computing capabilities, and refreshes a wide range of databases, runtimes, developer tools, and security components.
As an LTS release, Ubuntu 26.04 is designed for organizations that prioritize long-term stability while still needing access to modern hardware and infrastructure technologies. Standard security maintenance is scheduled through April 2031, while Ubuntu Pro can extend the support lifecycle considerably further.
The release is particularly relevant to server administrators, cloud operators, virtualization teams, AI infrastructure builders, and developers deploying Ubuntu across AMD64 and ARM64 systems.
🚀 Linux 7.0 Brings a Major Hardware Enablement Update #
Ubuntu 26.04 upgrades its generic kernel from Linux 6.8 to Linux 7.0, bringing a broad collection of hardware enablement and kernel infrastructure improvements.
Among the most notable additions is improved support for Intel Core Ultra Series 3 and Panther Lake, including optimizations for Intel Xe3 integrated graphics and integrated NPU hardware.
Other important kernel changes include:
- EtherCAT support for industrial real-time Ethernet deployments.
- PREEMPT_RT availability in the main Ubuntu archive, expanding access to real-time Linux capabilities without requiring Ubuntu Pro.
- ARM64 Livepatch support, allowing supported kernel security updates without conventional reboots.
- Kdump enabled by default, improving crash-dump availability on fresh installations.
- Sched_ext support, enabling eBPF-based scheduling mechanisms and user-defined scheduler implementations.
Ubuntu is also retiring the traditional lowlatency kernel package in favor of the generic kernel combined with user-space low-latency configuration mechanisms.
The result is a kernel platform that is better aligned with modern heterogeneous computing, industrial workloads, confidential computing, and real-time applications.
🖥️ New HWE Virtualization Stack Expands Deployment Flexibility #
Virtualization receives a substantial upgrade in Ubuntu 26.04, with improvements spanning QEMU, libvirt, EDK2, and SeaBIOS.
Key capabilities include:
- NVIDIA Multi-Instance GPU (MIG) configuration support through QEMU and libvirt.
- Intel Trusted Domain Extensions (TDX) host support.
- Improved virtual-machine firmware selection.
- NUMA affinity for PCI devices.
- Enhanced NVMe device management.
- AMD IOMMU support.
- AMD SEV-SNP confidential-computing capabilities.
- RISC-V RVA23 profile support.
One of the most important architectural changes is the introduction of a dedicated HWE virtualization stack.
Similar to Ubuntu’s HWE kernel model, the virtualization stack provides packages such as qemu-hwe, libvirt-hwe, seabios-hwe, and edk2-hwe. These components can receive updates twice per year while continuing to operate on the stable Ubuntu LTS foundation.
This gives infrastructure operators a useful compromise: a stable operating-system base without forcing virtualization environments to remain tied to older hardware enablement components throughout the entire LTS lifecycle.
🔐 Confidential Computing and Post-Quantum Security #
Security is another major focus of Ubuntu 26.04 LTS.
Intel TDX Host Support #
Ubuntu expands support for Intel Trusted Domain Extensions, or TDX, which allows virtual machines to operate as hardware-isolated Trusted Domains.
TDX is designed to protect guest workloads from threats originating in the hypervisor, host operating system, or neighboring virtual machines by combining encrypted memory with hardware-level isolation.
This is particularly important for cloud infrastructure where customers need stronger isolation guarantees from the underlying virtualization stack.
Post-Quantum Cryptography #
Ubuntu 26.04 also moves further toward post-quantum security.
OpenSSL includes support for algorithms including:
- ML-KEM
- ML-DSA
- SLH-DSA
OpenSSH additionally enables a hybrid post-quantum key-exchange mechanism by default.
The goal is not that conventional cryptography suddenly becomes obsolete, but that infrastructure can begin transitioning toward algorithms designed to withstand future quantum-computing threats.
AppArmor and Software Supply-Chain Security #
Ubuntu adds new AppArmor profiles for additional applications, strengthening application confinement.
Rust packages built through Launchpad can also use cargo-auditable, embedding dependency metadata into binaries. This makes it easier for security teams to determine whether deployed software contains dependencies affected by known vulnerabilities.
🗄️ PostgreSQL 18, MySQL 8.4 and Updated Application Stacks #
Ubuntu 26.04 refreshes a large portion of its server software ecosystem.
One of the most significant database updates is PostgreSQL 18, which introduces a new I/O subsystem and other improvements targeting database performance and usability.
Notable capabilities include:
- Improved storage-read performance.
- Better index utilization.
- Virtual generated columns.
uuidv7()for improved indexing scenarios.- OAuth 2.0 authentication support.
Ubuntu also includes MySQL 8.4 LTS, providing a long-term-support branch with updated internals and configuration changes.
Other infrastructure components include:
- Valkey 9.0
- DocumentDB
- PHP 8.5
- Django 5.2 LTS
- .NET 10
- OpenJDK 25
- GCC 15.2
- Python 3.14
- Rust 1.93
- LLVM 21
- Go 1.25
This broad software refresh makes Ubuntu 26.04 more than a kernel upgrade. It provides developers and infrastructure teams with a substantially modernized application platform.
🌐 OpenSSH, Chrony and Samba Receive Major Updates #
Ubuntu’s foundational infrastructure services also receive significant revisions.
OpenSSH 10.2 #
OpenSSH moves from the 9.x series to 10.2, with stronger cryptographic defaults.
Among the notable changes is support for the post-quantum hybrid key-exchange algorithm mlkem768x25519-sha256.
Weak DSA signature support has also been removed, further reducing reliance on outdated cryptographic mechanisms.
Chrony Becomes the Default Time Service #
For new installations, Chrony replaces systemd-timesyncd as the default time synchronization daemon.
Network Time Security (NTS) can provide authenticated and encrypted NTP communication, helping protect infrastructure from certain classes of time-synchronization attacks.
Accurate and trustworthy time synchronization is particularly important for distributed systems, authentication infrastructure, logging, and security monitoring.
Samba 4.23 #
Ubuntu 26.04 upgrades Samba to version 4.23, bringing several security and interoperability changes.
Fresh installations receive:
- SMB3 Unix Extensions enabled by default.
- NetBIOS disabled by default.
- LDAP TLS/SASL channel-binding support.
- Group Managed Service Account capabilities.
- Updated Active Directory functional-level support.
⚡ HAProxy 3.2 and Modern Network Infrastructure #
Ubuntu 26.04 includes HAProxy 3.2 LTS, bringing upstream improvements to high-performance load balancing and networking.
The release includes enhancements involving:
- QUIC performance.
- Runtime API handling.
- URI parsing.
- OCSP update configuration.
- General performance and reliability.
These changes matter particularly for web infrastructure where Ubuntu frequently serves as the operating system underneath reverse proxies, load balancers, API gateways, and distributed applications.
📦 Containers and Cloud Images Get a Modern Baseline #
Container infrastructure continues to receive regular updates through the Ubuntu release lifecycle.
The containerd and runc packages follow Ubuntu’s established balance between newer versions and stable maintenance paths, allowing administrators to choose the appropriate update strategy for their environments.
Ubuntu cloud images also move toward AMD64v3 as the default microarchitecture level for AMD64 cloud deployments.
This allows cloud images to take advantage of newer processor capabilities while maintaining compatibility with modern server hardware.
For organizations operating large fleets, the change can translate into better performance without requiring application-level changes.
🧰 Major Changes to Core System Infrastructure #
Ubuntu 26.04 introduces several changes beneath the familiar user-space environment.
sudo-rs Becomes the Default #
The Rust-based sudo-rs implementation becomes the default sudo implementation.
The traditional sudo implementation remains available under the sudo.ws package name, while the separate sudo-ldap package is removed in favor of LDAP authentication through PAM.
Rust-Based Core Utilities #
Ubuntu also moves toward rust-coreutils for its default core utilities.
The traditional GNU utilities remain available for compatibility, but the Rust implementation provides a modern alternative with a focus on memory safety and maintainability.
Dracut Replaces initramfs-tools #
Another significant infrastructure change is the move to Dracut as the default initramfs framework.
Dracut provides broader support for modern boot environments, including technologies such as Bluetooth and NVMe-over-Fabrics within the initial RAM filesystem.
APT 3.1 #
APT receives a major update as well.
APT 3.1 introduces a new dependency solver, switches TLS handling from GnuTLS to OpenSSL, adds an automatic pager for several commands, and removes the legacy apt-key command.
These changes continue Ubuntu’s gradual modernization of its package-management infrastructure.
🏗️ Architecture Requirements Become More Modern #
Ubuntu 26.04 also drops support for some older hardware platforms.
RISC-V #
Ubuntu 26.04 requires hardware implementing the RVA23S64 profile for its supported RISC-V configuration.
Older RVA20 systems continue to be supported by Ubuntu 24.04 LTS.
IBM Z #
The minimum supported IBM Z architecture level moves to z15, leaving z14 and older systems behind.
This allows the distribution to optimize more aggressively for contemporary enterprise hardware.
i386 Samba Changes #
The python3-samba package is no longer built for i386 because of dependencies involving modern Python cryptography components.
These changes illustrate a broader trend: Ubuntu is gradually reducing the maintenance burden associated with aging architectures while concentrating development resources on hardware platforms with longer-term relevance.
📊 Ubuntu 26.04 LTS at a Glance #
| Area | Ubuntu 26.04 LTS |
|---|---|
| Codename | Resolute Raccoon |
| Release Type | Long-Term Support |
| Kernel | Linux 7.0 |
| Default Java | OpenJDK 25 |
| Python | Python 3.14 |
| PostgreSQL | PostgreSQL 18 |
| MySQL | MySQL 8.4 LTS |
| PHP | PHP 8.5 |
| GCC | GCC 15.2 |
| LLVM | LLVM 21 |
| OpenSSH | OpenSSH 10.2 |
| Samba | Samba 4.23 |
| HAProxy | HAProxy 3.2 LTS |
| Default Time Daemon | Chrony |
| Default Initramfs | Dracut |
| Standard Support | Through April 2031 |
| Ubuntu Pro | Extended lifecycle options |
🔭 Why Ubuntu 26.04 Matters for Infrastructure #
Ubuntu 26.04 LTS is important because several previously separate technology trends are converging inside a single LTS platform.
The release combines:
- Linux 7.0 hardware enablement
- Confidential virtual machines
- Modern GPU virtualization
- Real-time Linux capabilities
- ARM64 Livepatch
- Post-quantum cryptography
- Modern database engines
- Updated container infrastructure
- AMD64v3 cloud images
- Modernized boot and package-management infrastructure
For desktop users, some of these changes may remain largely invisible. For servers, cloud platforms, virtualization clusters, and AI infrastructure, however, they represent meaningful changes to the underlying operating environment.
The new HWE virtualization model is especially interesting because it provides a mechanism for bringing newer virtualization technologies into an LTS release without forcing the entire operating system onto a faster-moving development cadence.
🏁 Final Thoughts #
Ubuntu 26.04 LTS is more than a routine two-year refresh. Linux 7.0, improved virtualization, Intel TDX, post-quantum cryptography, PostgreSQL 18, modern developer runtimes, Dracut, Chrony, and the new HWE virtualization model collectively push Ubuntu’s infrastructure stack toward the requirements of the next generation of computing.
The release also demonstrates where enterprise Linux is heading: stronger hardware isolation, more capable virtualization, greater support for heterogeneous computing, modern cryptography, and increasingly automated infrastructure management.
Organizations running production workloads may still prefer to wait for the first point release before performing broad upgrades. For new deployments, development environments, and hardware requiring the latest kernel capabilities, however, Ubuntu 26.04 LTS provides a compelling modern foundation.
With standard support extending through April 2031 and Ubuntu Pro offering a longer maintenance horizon, Resolute Raccoon is positioned to become one of the major Linux infrastructure platforms of the second half of the decade.