What’s new in security for Ubuntu 26.10?

Key points

Canonical has published its rundown of security changes in Ubuntu 26.10 "Stonking Stingray". The theme is less code in privileged components and more memory safety: a slimmed-down signed GRUB, core utilities fully in Rust, OpenSSL 4.0, dbus-broker as the default bus and Linux 7.3. Several changes need checking before you upgrade. Ubuntu 26.10 is supported until July 2027.

A smaller Secure Boot path

• Signed GRUB builds keep only what Ubuntu needs to boot: /boot on ext4, FAT and ISO9660, plus squashfs for snaps.
• Removed from the signed build: Btrfs, HFS+, XFS and ZFS drivers, JPEG and PNG image loading, and Apple partition tables.
• /boot on LVM, on software RAID other than RAID1, or LUKS-encrypted is no longer supported under Secure Boot.
• Only the boot path is affected: LVM, RAID, LUKS, Btrfs and ZFS keep working in the running system, and the full GRUB feature set remains with Secure Boot disabled.
• Anyone who depends on the removed features can stay on Ubuntu 26.04 LTS, covered until May 2041 with Ubuntu Pro and the Legacy add-on.

TPM-backed disk encryption

• Now available on machines without a hardware root of trust. Ubuntu cannot verify the firmware there, so a PIN or passphrase is required at installation; it can be removed later, at the cost of protection against firmware tampering.
• Machines with a hardware root of trust (most PCs made since 2021) keep unlocking automatically.
• fwupd asks for the recovery key only when a firmware update could affect the measurements used to unlock the disk. This fix was also backported to 26.04 LTS.

Core utilities entirely in Rust

• 26.04 LTS kept the GNU versions of cp, mv and rm; 26.10 migrates them, so the default core utilities are all Rust (uutils).
• Canonical asks users to test scripts that rely on subtle command behaviour, especially privileged ones that copy, move or delete files.

OpenSSL 4.0, upki and OpenSSH 10.5

• OpenSSL 4.0 is the first new major version since 3.0. ML-KEM, ML-DSA and SLH-DSA are available, and hybrid post-quantum key exchange is preferred by default in TLS when the peer supports it.
• New: the curveSM2MLKEM768 hybrid group, the ML-DSA-MU pseudo-digest, cSHAKE, and Encrypted Client Hello (ECH), which applications must enable themselves.
• Removed or restricted: the ENGINE interface (use providers), SSLv3, deprecated elliptic curves in TLS and explicit curve parameters; certificate and revocation checks are stricter.
• If you use OpenSSL engines for HSMs, PKCS#11 tokens or TPM-backed keys, move to the equivalent provider and test the migration.
• upki brings system-level certificate revocation using locally cached CRLite data, updated in the background. In 26.10 it is integrated with curl.
• OpenSSH 10.5 keeps hybrid post-quantum key exchange as the default. An empty certificate principals list no longer acts as a wildcard with the principals= option of authorized_keys, sshd correctly enforces accepted ECDSA algorithms, and command-line user names are validated earlier.

dbus-broker replaces dbus-daemon

• dbus-daemon, used since 2004, gives way to dbus-broker for the system bus and every user session bus, on fresh installs and upgrades.
• AppArmor mediation of D-Bus messages is preserved, so existing confinement policies stay enforced.

Also in this release

• ntpd-rs, a memory-safe NTP implementation, is in the archive for testing; the goal is to make it the default in Ubuntu 27.04. Canonical became a Gold Sponsor of the Trifecta Tech Foundation and funds work on parity with chrony.
• authd adds sign-in with a Microsoft password plus MFA through Microsoft Authenticator, derives user and group IDs from identity-provider attributes, and lets administrators disable local password authentication for those accounts.
• NetworkManager gains PKCS#11 and smart-card support for VPN, so hardware tokens such as YubiKeys work from the desktop interface.
• Myna, the new desktop dictation feature, runs speech recognition locally in a sandboxed inference snap; audio is processed in memory, discarded and never uploaded.
• Linux 7.3 brings updates to Landlock, AppArmor, SELinux and Smack, TPM driver updates, BPF verifier fixes against pointer leaks on speculative paths, NTFS3 hardening and Rust support on PowerPC.

Summary by DistroNews, based on the original post.