--- title: Ubuntu Updates for the Meltdown / Spectre Vulnerabilities description: 'For up-to-date patch, package, and USN links, please refer to: https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown   Unfortunately, you’ve probably already read about one of the most widespread security issues in modern computing history — colloquially known as “Meltdown” (CVE-2017-5754) and “Spectre” (CVE-2017-5753 an […]' url: https://canonical.com/blog/ubuntu-updates-for-the-meltdown-spectre-vulnerabilities?format=md --- 1. [Blog](https://canonical.com/blog) 2. Article --- [Dustin Kirkland](https://canonical.com/blog/author/kirkland "More about Dustin Kirkland") 4 January 2018 # Ubuntu Updates for the Meltdown / Spectre Vulnerabilities [Canonical](https://canonical.com/blog/tag/canonical) [Cloud security](https://canonical.com/blog/tag/cloud-security) [iot security](https://canonical.com/blog/tag/iot-security) [Security](https://canonical.com/blog/tag/security) [Ubuntu](https://canonical.com/blog/tag/ubuntu) [Ubuntu Desktop](https://canonical.com/blog/tag/ubuntu-desktop) --- Share the article * For up-to-date patch, package, and USN links, please refer to: Unfortunately, you’ve probably already read about one of the most widespread security issues in modern computing history — colloquially known as “[Meltdown](https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability))” ([CVE-2017-5754](https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5754.html)) and “[Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))” ([CVE-2017-5753](https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5753.html) and [CVE-2017-5715](https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5715.html)) — affecting practically every computer built in the last 10 years, running any operating system.  That includes [Ubuntu](https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown). I say “unfortunately”, in part because there was a coordinated release date of January 9, 2018, agreed upon by essentially every operating system, hardware, and cloud vendor in the world.  By design, operating system updates would be available at the same time as the public disclosure of the security vulnerability.  While it happens rarely, this an industry standard best practice, which has broken down in this case. At its heart, this vulnerability is a CPU hardware architecture design issue.  But there are billions of affected hardware devices, and replacing CPUs is simply unreasonable.  As a result, operating system kernels — Windows, MacOS, Linux, and many others — are being patched to mitigate the critical security vulnerability. Canonical engineers have been working on this since we were made aware under the embargoed disclosure (November 2017) and have worked through the Christmas and New Years holidays, testing and integrating an incredibly complex patch set into a broad set of Ubuntu kernels and CPU architectures. Ubuntu users of the 64-bit x86 architecture (aka, amd64) can expect updated kernels by the original January 9, 2018 coordinated release date, and sooner if possible.  Updates will be available for: * Ubuntu 17.10 (Artful) — Linux 4.13 HWE * Ubuntu 16.04 LTS (Xenial) — Linux 4.4 (and 4.4 HWE) * Ubuntu 14.04 LTS (Trusty) — Linux 3.13 * Ubuntu 12.04 ESM\*\* (Precise) — Linux 3.2 + Note that an [Ubuntu Advantage license](https://www.ubuntu.com/support/esm) is required for the 12.04 ESM kernel update, as Ubuntu 12.04 LTS is past its end-of-life Ubuntu 18.04 LTS (Bionic) will release in April of 2018, and will ship a 4.15 kernel, which includes the [KPTI](https://lwn.net/Articles/742404/) patchset as integrated upstream. Ubuntu optimized kernels for the Amazon, Google, and Microsoft public clouds are also covered by these updates, as well as the rest of Canonical’s [Certified Public Clouds](https://partners.ubuntu.com/programmes/public-cloud) including Oracle, OVH, Rackspace, IBM Cloud, Joyent, and Dimension Data. These kernel fixes will not be [Livepatch-able](https://www.ubuntu.com/server/livepatch).  The source code changes required to address this problem is comprised of hundreds of independent patches, touching hundreds of files and thousands of lines of code.  The sheer complexity of this patchset is not compatible with the Linux kernel Livepatch mechanism.  An update and a reboot will be required to active this update. Furthermore, you can expect Ubuntu security updates for a number of other related packages, including CPU microcode, GCC and QEMU in the coming days. We don’t have a performance analysis to share at this time, but please do stay tuned here as we’ll followup with that as soon as possible. Thanks, [@DustinKirkland](https://twitter.com/dustinkirkland) VP of Product Canonical / Ubuntu ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. By submitting this form, I confirm that I have read and agree to [Canonical's Privacy Policy](https://canonical.com/legal/dataprivacy). Sign up ## Share on --- ## Related posts [### Arduino® VENTUNO™ Q is available for pre-order with Ubuntu pre-installed](https://canonical.com/blog/arduino-ventuno-q-is-available-for-pre-order-with-ubuntu-pre-installed) London, UK – August 25, 2026 – Following our initial collaboration announcement in March 2026, Canonical and Arduino (a subsidiary of Qualcomm Technologies, Inc.) are excited... [Canonical](https://canonical.com/blog/author/canonical) 25 August 2026 [### Canonical joins the Open Secure AI Alliance](https://canonical.com/blog/open-secure-ai-alliance) Canonical is now part of the Open Secure AI Alliance, announced by NVIDIA with partners across cloud computing, cybersecurity, enterprise software, open source foundations, and... [Canonical](https://canonical.com/blog/author/canonical) 28 August 2026 [### Januscape vulnerability CVE-2026-53359 mitigations available](https://canonical.com/blog/januscape-linux-vulnerability-mitigations-available) Introduction A local privilege escalation (LPE) vulnerability affecting the Linux kernel was publicly disclosed on July 6, 2026. The vulnerability was assigned CVE ID... [seth-arnold](https://canonical.com/blog/author/seth-arnold) 11 July 2026 [### DirtyClone Linux kernel local privilege escalation vulnerability fixes available](https://canonical.com/blog/dirtyclone-linux-vulnerability-fixes-available) On June 25, 2026, JFrog published their research into CVE-2026-43503, referring to the vulnerability as DirtyClone. The vulnerability had previously been responsibly disclosed... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026