Run an Ubuntu release that still receives security updates

Description

Each Ubuntu LTS release gets five years of standard security maintenance for the packages of the main and restricted components. Expanded Security Maintenance (ESM), part of Ubuntu Pro, then extends it for five more years (esm-infra), and also covers universe (esm-apps, see CB-UBU-PKG-014). After the standard period, a system only receives security fixes for main if it is attached to Ubuntu Pro with esm-infra enabled. Interim releases (YY.10) are supported for nine months only.

On 2026-10-19: standard security maintenance ends in April 2027 for 22.04, April 2029 for 24.04 and April 2031 for 26.04; 20.04 left it in May 2025 and is supported only with esm-infra (until April 2030). Move a release from supported_versions to esm_versions when its standard support ends, and remove it from both at the end of ESM (see the Ubuntu release cycle page). Plan upgrades before the date rather than after.

Rationale

An unsupported release accumulates known, public, unfixed vulnerabilities. No configuration hardening compensates for that. A release past its standard support looks maintained (the archive still answers, apt-get upgrade reports nothing) while fixes are published only in ESM, which makes this failure easy to miss.

Impact

Upgrading to the next LTS release needs planning and testing of the hosted applications. Keeping an older release needs an Ubuntu Pro subscription for each system.

Setting

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Run . /etc/os-release; echo "$VERSION_ID" and compare with the dates on https://ubuntu.com/about/release-cycle.
2. For a release past its standard support, pro status must show the system attached and esm-infra enabled.

Automated: every check must pass. Scanners report each check by its id.

release

VERSION_ID from /etc/os-release against the supported lists, and the esm-infra service of the Ubuntu Pro client.

script: |
  v=$( (. /etc/os-release && printf '%s' "${VERSION_ID:-}") 2>/dev/null)
  echo "VERSION_ID ${v:-none}, standard support: $CB_SUPPORTED_VERSIONS, ESM: $CB_ESM_VERSIONS"
  for s in $CB_SUPPORTED_VERSIONS; do
    [ "$s" = "$v" ] && exit 0
  done
  for s in $CB_ESM_VERSIONS; do
    [ "$s" = "$v" ] || continue
    if pro api u.pro.status.enabled_services.v1 2>/dev/null | grep -Eq '"name": ?"esm-infra"'; then
      echo "esm-infra enabled"
      exit 0
    fi
    echo "past standard support and esm-infra is not enabled"
    exit 1
  done
  echo "release not supported"
  exit 1

Remediation

Upgrade to a supported LTS release with do-release-upgrade, one LTS at a time, after testing the hosted applications. Until then, attach the system to Ubuntu Pro (pro attach <token>, or through Landscape or the cloud provider's Pro images) and run pro enable esm-infra. Move systems running an interim release to an LTS release.

References

• Ubuntu release cycle Canonical, vendor-doc, accessed 2026-10-19
• Ubuntu - Expanded Security Maintenance Canonical, vendor-doc, accessed 2026-10-19
• Ubuntu Pro Client - How to enable ESM Infra Canonical, vendor-doc, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-UBU-PKG-006 Configure the Ubuntu security pocket
• related CB-UBU-PKG-008 Leave no security update pending
• related CB-UBU-PKG-014 Receive security updates for every installed package, including universe (Ubuntu Pro esm-apps)

People and lifecycle