Ubuntu 26.10, codenamed Stonking Stingray, changes several parts of the system that server admins depend on most: the boot loader, disk encryption, the default SSH and TLS behaviour, and the basic file tools. Most of these changes will not affect a fresh install, but a few can break an existing boot layout, an OpenSSL engine setup, or a script that depends on exact copy and delete behaviour. This post explains what changes, what to check on your current systems, and how to plan the move. Ubuntu 26.10 is a non-LTS release supported until July 2027, so it fits test machines and labs better than long-lived production servers, which should stay on Ubuntu 26.04 LTS.
What is changing in Ubuntu 26.10
The release ships with Linux kernel 7.3 and a set of security-focused changes. The ones with the most operational impact are the signed GRUB build, TPM-backed disk encryption, Rust-based core utilities, OpenSSL 4.0, OpenSSH 10.5, and dbus-broker as the default message bus. Ubuntu also adds system-wide certificate revocation checks through a tool called upki, and extends authd so that logins can use identity-provider accounts with stable user and group IDs across a fleet.
Boot loader and disk encryption
The signed GRUB in Ubuntu 26.10 is slimmer. Ubuntu removed the Btrfs, HFS+, XFS and ZFS drivers from the signed build, along with JPEG and PNG loading and Apple partition tables. The goal is to reduce the boot-time parsers that Secure Boot bypasses have targeted. The running system still supports LVM, RAID, LUKS, Btrfs and ZFS. The boot loader is the part that changes.
Under Secure Boot, /boot must sit on ext4, FAT, ISO9660 or squashfs for snaps. Layouts with /boot on LVM, on RAID other than RAID1, or on LUKS are no longer supported in that mode. Check your current layout before you upgrade:
lsblk -f
findmnt /boot
mokutil --sb-state
The same release adds TPM-backed full disk encryption for machines without a hardware root of trust. The TPM releases the key only when the measured boot state matches the configured policy. On those machines, a PIN or passphrase is required at install time. If you remove that PIN later, the disk is no longer protected against firmware tampering. Machines with a hardware root of trust still unlock automatically, which the article says covers most PCs made since 2021. A fwupd change also means a recovery key is requested only when a firmware update could affect the unlock measurements. Ubuntu backported that fix to 26.04 LTS.
OpenSSL 4.0 and OpenSSH 10.5
OpenSSL 4.0 is the first new major version since 3.0. It adds ML-KEM, ML-DSA and SLH-DSA, and prefers hybrid post-quantum key exchange in TLS when the peer supports it. It also adds Encrypted Client Hello, although applications must enable it and it does not hide destination IP addresses.
The compatibility impact is in what was removed. The ENGINE interface is replaced by providers, SSLv3 is gone, and certificate checks are stricter. If your application loads HSM, PKCS#11 or TPM engines, plan a move to providers and test it before the upgrade. Check the installed version with:
openssl version -a
OpenSSH 10.5 makes hybrid post-quantum key exchange the default. It also includes fixes from 10.3, including a change to the authorized_keys principals= option: an empty list no longer acts as a wildcard. If you use certificate-based logins, review those entries. You can list the key exchange methods a server will offer with:
sudo sshd -T | grep -i kexalgorithms
Core utilities, D-Bus and services
Ubuntu 26.10 moves the remaining GNU implementations of cp, mv and rm to the Rust uutils versions, so the default core utilities are now fully Rust. Safe Rust removes many memory-safety bugs, but it does not fix logic errors. Scripts that depend on edge-case behaviour, especially privileged copy, move or delete jobs, should be tested in staging. Backup and cleanup scripts are the first place to look.
dbus-broker replaces dbus-daemon as the default message bus, for both the system bus and user session buses, on fresh installs and upgrades. AppArmor still controls which D-Bus messages applications can send and receive. If you have custom D-Bus policy files, test those services after the upgrade.
Upgrade checklist
- Take a full backup and confirm you can restore it, including
/bootand the EFI partition. - Record the boot layout with
lsblk -f,findmnt /bootandmokutil --sb-state, and compare it with the supported list above. - Find applications that load OpenSSL ENGINE modules or HSM drivers and confirm they have a provider path.
- Test scripts that run
cp,mvorrmwith unusual flags or on unusual paths. - Review SSH
principals=entries and custom D-Bus policies. - Apply current updates on your existing release first with
sudo apt updateandsudo apt full-upgrade, then reboot and confirm the system comes up cleanly. - Upgrade a staging machine with
sudo do-release-upgradebefore touching production.
If you depend on the GRUB features that were removed from the signed build, the article notes that you can stay on Ubuntu 26.04 LTS, which it says is supported until May 2041 with Ubuntu Pro and the Legacy add-on.
How TechProvidence can help
Major Ubuntu releases touch boot, crypto and login paths all at once, and a rushed upgrade can leave a server unbootable or an application unable to connect. TechProvidence plans and runs these upgrades for Linux servers: we audit boot layouts and encryption setup, test scripts and SSH and TLS configuration in staging, and schedule the production move with a tested rollback. If you want a second pair of eyes on an upgrade plan, contact us.
Source: Ubuntu blog
