Ubuntu 26.10 Release Notes

These release notes cover new features and changes in Ubuntu 26.10 (Stonking Stingray).

Ubuntu 26.10 (Stonking Stingray) is currently in development, scheduled to be released in October 2026.

For the release schedule of Ubuntu 26.10, refer to the release schedule.

To upgrade from a previous Ubuntu release, refer to the Ubuntu Desktop or Ubuntu Server guide.

Performance: many enhancements to bring a smoother, more responsive desktop.

Displays remembers monitor brightness across reboots and HDR changes. Frame scheduling improvements make animations smoother under load, and monitor arrangement uses improved center-aligned snapping.

Settings adds an automatic screen rotation and orientation lock on devices with an accelerometer, improves display arrangement, and can disable the touchpad automatically when a mouse is connected. Network settings now support DNS search domains, and fingerprint enrollment has an improved interface.

Files gives a count when dragging multiple files, improves selection behavior, groups file notifications, and performs some file operations more responsively.

Calendar is more responsive, especially in Month view, and uses less data when syncing.

Remote Desktop supports remote smartcard use and Kerberos authentication. Remote Login also supports SSH socket-activated servers.

Papers can add visual signatures to documents. These are annotations and do not cryptographically verify a document’s authenticity.

For more information, see the GNOME 51 release notes.

Accessibility has been improved across GNOME, App Center, the desktop shell and the Flutter toolkit.

GNOME 51 comes with many accessibility enhancements:

The Reduced Motion setting has been extended to more parts of the desktop.

Users can adjust screenshot selections with the keyboard

Orca announcements and app-grid navigation have been improved.

The Accessibility settings gain an option to disable the focus-ring timeout.

Ubuntu 26.10 includes new Stonking Stingray wallpapers, including designs selected through the community wallpaper competition. See the wallpaper announcement.

Settings can show whether a computer is certified for Ubuntu.

The status is checked using the Ubuntu Hardware API, with caching to avoid unnecessary repeated checks. The hwctl client is included as a snap.

For information about hardware data used for certification checks, see the System Information Notice.

App Center now presents Snap and Debian package details in a unified app-details view. It brings information such as the publisher, ratings, permissions, version, package size, screenshots, and description together, with the relevant install, open, or uninstall action.

App Center adds a dedicated Drivers page where you can review the available graphics drivers, including NVIDIA driver branches.

Driver choices are presented with clearer metadata to help you compare the options. Available choices depend on the system’s hardware and enabled software sources.

App Center can install the codecs needed for one-time playback when a media file uses a codec that is not installed. Some high-quality codecs are proprietary and are not included in the default installation.

Myna is an early speech-to-text preview for Ubuntu Desktop.

Hold a configurable key to dictate into the focused app. The transcription runs locally, with no audio sent to a network service.

Myna is not preinstalled, and its features may change before stable release.

Read the Myna technology preview announcement.

Computers without a hardware root of trust can now be installed with TPM-backed full disk encryption (FDE), provided that a PIN or passphrase is also set on the TPM-backed key.

This was already backported in Ubuntu Desktop 26.04.1. For reference, see Hardware-backed disk encryption requirements.

While systems running under TPM-backed FDE will not be able to upgrade from Ubuntu 26.04 LTS to Ubuntu 26.10 on release, we anticipate enabling these upgrades during the Ubuntu 26.10 lifecycle.

Administrators can now opt out of anonymous Ubuntu Insights system report collection for the entire system. Enabling the configuration overrides individual opt-ins such that they are instead interpreted as opt-outs. Users with sufficient permissions can change this setting, either in the Settings application or by using Ubuntu Insights’ command-line interface.

The FreeRADIUS software was updated to version 3.2.10. Highlights include:

Initial implementation of Protocol-Failure as per IETF draft

Suppress secrets by default in new installations (supress_secrets=true)

Please refer to the FreeRADIUS release notes for more details.

The FRRouting (frr) software was updated to version 10.7.1. Highlights include:

BFD authentication with keychain support (10.7.0)

And many more improvements and bug fixes.

Refer to the respective release notes for more information:

FRRouting 10.7.0 release notes and FRRouting 10.7.1 release notes

FRRouting 10.6.0 release notes and FRRouting 10.6.1 release notes

HAProxy jumped two feature releases, from 3.2 to upstream version 3.4.2. HAProxy 3.4 is an LTS branch, supported upstream until 2031-Q2.

The default load balancing algorithm changed from roundrobin to random (power of two choices).

cpu-policy now defaults to performance, and the number of threads is no longer capped at 64.

Backends in mode http now enable option abortonclose by default.

See the HAProxy 3.3 and HAProxy 3.4 announcements for the complete list of changes.

iPXE was updated from 1.21.1+git to 2.0.0. Highlights of changes:

EAPoL, port authentication, LLDP, initrd-style CPIO, DHC/ECDHE kex, GCM cipher, X25519, P-256/P-384 EC, ECDSA certs

libp11 was updated from 0.4.18 to upstream version 0.4.20. Highlights include:

Post-quantum cryptography support (ML-DSA, SLH-DSA, and FALCON key generation, signing, and verification).

OpenSSL 4.x support and a more complete PKCS#11 provider.

And many other improvements and bug fixes.

See the 0.4.19 and 0.4.20 upstream release notes for full details.

Postfix in Ubuntu Server 26.10 has been updated to version 3.11.7.

Several tools now support JSON output: postconf, postalias, postmap, and postmulti.

See the Postfix 3.11.0 announcement for the full list of changes.

Samba in Ubuntu Server 26.10 has been updated to version 4.24.7. Important changes include:

New audit logging classes for some Active Directory attributes.

vfs_streams_xattr can hold larger streams.

Support for remote password management for Entra ID SSPR and Key cloak.

Support for Windows Strong and Flexible key mappings as outlined in KB5014754: Certificate-based authentication changes on Windows domain controllers.

Domain encryption types changed to AES by default.

And many other improvements and bug fixes.

Please see the Samba 4.24.0 release notes for the full list of changes.

MySQL was updated from 8.4 LTS to 9.7 LTS, starting with 9.7.2. This is MySQL’s latest long term support release, including new features such as the Hypergraph Optimizer, full JSON Duality Views support, and the Telemetry component.

Upstream release notes are available in the Mysql 9.7 documentation library. For more information about the transition from MySQL 8.4 to 9.7, see the MySQL 9.7 overview.

MySQL Shell was updated to 9.7.1 to support the new MySQL LTS version. See the upstream release notes for more information.

Valkey was updated to the latest major release 9.1, starting with 9.1.2. This includes various performance and security threat model improvements.

For more information on the new version, see the Valkey 9.1 blog post. Release notes are available on the Valkey project GitHub.

ssl-cert is a simple wrapper around OpenSSL. It provides the make-ssl-cert helper script and generates the “snakeoil” self-signed TLS certificate/key pair (/etc/ssl/certs/ssl-cert-snakeoil.pem and /etc/ssl/private/ssl-cert-snakeoil.key) used by services that need a default certificate out of the box (e.g. Apache, Postfix, Dovecot). It also manages the ssl-cert system group that grants read access to private keys.

Increased the default generated key length from 2048 to 3072 bits, while leaving existing 2048-bit keys untouched.

Allowed separate key/cert file paths even outside the generate-default-snakeoil mode.

Added the ability to override the certificate’s CN and SubjectAltName from the command line.

net-snmp provides the suite of applications used to implement the Simple Network Management Protocol (SNMP v1, v2c, v3), including snmpd (the agent/daemon), snmptrapd (trap receiver), command-line query tools (snmpget, snmpwalk, etc.), and the development libraries (libsnmp-dev) used by monitoring software to query and manage network devices and hosts.

Ported the SSH domain transport to FreeBSD.

EtherLike-MIB: optimized the Linux implementation to use netlink statistics.

LM-SENSORS-MIB: added support for negative temperatures.

SNMP-TLS-TM-MIB: updated to RFC 9456 and allowed TLS protocols higher than TLS 1.0.

HOST-RESOURCES-MIB: added support for RPM SQLite DB background.

rdma-core provides the userspace components for the Linux RDMA (Remote Direct Memory Access) subsystem used to configure and use InfiniBand/RoCE/iWARP networking and storage (NVMe-oF, SRP, etc.) devices.

Added DMA-buf heap and Confidential-Computing (CoCo) shared-memory allocation support, including a new internal DMA-buf heap allocator library in libibverbs and per-buffer dmabuf UMEM attribute passthrough to the kernel.

Introduced mlx5dv_devx_uar_export_dmabuf_fd() and DM export DMABUF fd support.

Enabled ST64B for BlueFlame writes (with aarch64 mmio_memcpy_x64 support).

bnxt_re provider: added support for QP rate limiting (ibv_modify_qp_rate_limit) and reporting of rate-limit capabilities.

efa provider: added a new completion status for feature mismatch; added QP generation to the device request ID; removed unused cur_qp caching in efa_poll_sub_cq.

mana provider: added Unreliable-Connection (UC) QP support, robust udata handling, and fixed lost CQ notifications when re-arming without polling (the cqid-check fix that Ubuntu had carried as a local patch in 61.0-2ubuntu3 is included upstream as of 63.0-1).

ionic provider: fixed sq_sig_all handling for signaled completions.

pyverbs: numerous enhancements — WR property getters, ParentDomain CC unprotected allocation, CoCo DMA bounce device capability flag, ibv_buf provider-aware buffer support, fixed a MREx.close() deallocation crash, replaced unsafe WeakSet.pop() usage, and other cleanup/robustness fixes.

rc_pingpong: added unprotected memory allocation for CoCo guests, buffer-allocation ordering fix, and preference for IPv6 wildcard when binding the control channel.

libmail-dmarc-perl is a Perl implementation of DMARC (Domain-based Message Authentication, Reporting and Conformance). It is used by MTAs and filtering tools (e.g. SpamAssassin) to:

Validate that incoming messages align with the purported sender’s SPF/DKIM policy (Mail::DMARC::PurePerl->validate).

Receive, store and view DMARC aggregate/forensic reports from other mail servers (report store with SQLite/MySQL/PostgreSQL backends, CLI, and web viewers).

Send DMARC reports to author domains as an MTA operator.

Between Ubuntu 26.04 LTS (Resolute Raccoon) and Ubuntu 26.10 (Stonking Stingray), libmail-dmarc-perl moved from upstream 1.20250805 to 1.20260306, bringing new report-handling robustness (gzip/zip ingestion, error-tolerant archive parsing), a modernized web reporting UI (DataTables), new filtering/CLI options for dmarc_view_reports, and a new SQLite-MySQL migration helper.

New dmarc_sqlite_to_mysql migration script.

MySQL: enable SSL for newer MySQL; fixed schema for new imports.

dmarc_receive: eval unzip/ungzip, so imperfect archives no longer interrupt the processing loop.

dmarc_receive: support for gzip, zip, and XML report files (#277).

strongswan is a complete, open-source IKEv1/IKEv2 IPsec implementation for Linux (and other UNIX-like systems). It