Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Extended support does not automatically mean every vulnerability in every installed package will receive a security fix. Coverage depends on the Linux distribution, release and minor release, package or module, architecture, repository, vendor policy, and your subscription entitlement. Treat a scanner alert as a prompt to check the vendor’s status and your actual coverage—not as proof that a fix is or is not available.
What extended support does—and does not—promise
“Extended support” is not a shared Linux industry guarantee. It is a product-specific lifecycle phase or paid service, with its own dates, eligible content, severity rules, and support limits. Some services provide security errata for eligible releases; other lifecycle phases preserve access to existing content without issuing new security fixes.
Even where security updates are offered, coverage may be limited by package, repository, module, architecture, or vendor severity criteria. A subscription can therefore be active while a particular finding is outside its scope. Check the policy and entitlement for the exact deployment rather than inferring coverage from the words “extended support,” “long-term support,” or “extended security.”
How the policies differ by distribution
These examples illustrate why product names and lifecycle phases matter. They are not interchangeable promises, and eligibility can vary by release and subscription.
#1 Best Overall
| Distribution and service | What the cited policy says | Important scope limit |
|---|---|---|
| Ubuntu LTS with Ubuntu Pro ESM | Canonical describes five years of standard security maintenance for Main packages, followed by ESM coverage. Its CVE guidance describes 10 years of security updates for Main and more than 23,000 Universe packages, with the Legacy add-on providing five additional years; the ESM page lists timelines of up to 15 years when ESM and Legacy coverage apply. Canonical’s ESM page and CVE guidance | The package count is a coverage descriptor, not a guarantee that every package or CVE is fixed. Canonical’s legal service description says ESM does not guarantee fixes for every High or Critical CVE and sets repository, architecture, and package limits. Ubuntu Pro service description |
| Red Hat Enterprise Linux Extended Life Phase | For RHEL 8, 9, and 10, Red Hat describes 10 years in Full Support and Maintenance Support, followed by the Extended Life Phase. In that phase, subscribers retain access to previously released content and receive limited technical support. RHEL lifecycle policy | The Extended Life Phase provides no new bug fixes, security fixes, hardware enablement, or root-cause analysis. It is not the same as an extended errata stream. |
| Red Hat ELCP and Long-Life extensions | For eligible minor releases, Red Hat says the Extended Life Cycle Phase (ELCP) can provide errata for six years from general availability on eligible even-numbered minor releases and nine years on terminal .10 releases. Renewable annual Long-Life extensions may add coverage afterward. RHEL lifecycle policy | These are eligibility- and release-specific terms. Red Hat says ELCP replaces legacy ELS beginning with RHEL 8.10 on 2029-06-01; existing active legacy streams continue through their committed end dates. Its legacy offerings page says EUS, Enhanced EUS, E4S, and ELS are being superseded by ELC. Legacy extended support offerings |
| SUSE SLES 12 SP5 LTSS Extended Security | SUSE’s policy for this specific product and subscription covers the base system. SUSE product lifecycle policies | Additional modules are excluded under the cited SLES 12 SP5 policy. Do not apply this rule to other SUSE releases without checking their terms. |
Severity rules also matter. Red Hat’s lifecycle policy states that, effective 2025-04-01, its standard security errata criteria include Critical, Important, and Moderate CVEs with CVSS 7 or higher, while errata remain at Red Hat’s discretion. The same policy notes that Package Application Streams may have shorter lifecycles than the base OS. Confirm current criteria and applicability in the vendor policy before relying on them.
Why a scanner finding is not the final answer
Scanners identify a possible vulnerability from package data, version comparisons, or other signals. A finding alone does not establish whether the vendor considers the installed build affected or has already issued a fix. Linux vendors may backport a security patch while keeping an upstream-looking version number, so comparing only that number with an upstream release can produce a misleading result.
For Ubuntu, the public CVE Tracker reports package status by supported version, and Canonical describes machine-readable security information in formats including OVAL, OSV, and VEX. Ubuntu CVE guidance and Ubuntu Security Assurances. For Red Hat, consult the security advisory and lifecycle policy to verify erratum applicability and support phase. In either case, match the finding to the precise distribution release and installed package build.
Check whether a CVE is covered on your system
- Identify the deployment. Record the distribution, major and minor release, architecture, support phase, enabled repositories, installed package versions, and application modules. Do not stop at the major release name: minor-release eligibility and module lifecycles can change the answer.
- Verify the finding with the vendor. Search the distribution’s CVE tracker or security advisory for the CVE, package, and release. Determine whether the vendor marks the package affected, fixed, not affected, or otherwise addressed. Compare the installed build with the vendor’s fixed build or advisory instructions, not just an upstream version string.
- Match the fix to your entitlement. Confirm that the specific package or module, repository, architecture, and release are included in the support stream you actually have. Check the service dates, renewal status, and any exclusions.
- Check the vendor’s criteria. Establish whether the CVE qualifies under that service’s current severity and policy rules, and whether the vendor promises a fix or retains discretion over errata. Do not assume that a High or Critical rating alone guarantees a patch.
- Apply and verify an available fix. Use the vendor-supported repository and update procedure. After installation, confirm the resulting package build and rescan or otherwise validate that the finding is resolved.
- Record the decision and owner. Keep the scanner result, vendor advisory or tracker status, installed build, entitlement evidence, action taken or exception, responsible owner, and target migration date together.
When a fix is not available or not covered
If the vendor marks a CVE as not affected or already fixed in the installed build, retain the advisory or tracker evidence so the scanner result can be assessed against it. If the package is affected but no covered fix is available, make an explicit risk decision rather than treating the support subscription as remediation.
- Mitigate: Apply a vendor-recommended workaround or reduce exposure with configuration changes and compensating controls. Validate that the control addresses the affected attack path.
- Isolate: Restrict network access, privileges, or system interactions where that meaningfully reduces exposure. Isolation reduces risk; it does not make an affected package patched.
- Upgrade or migrate: Move to a supported release or replace the component when the required fix, coverage, or lifecycle certainty is unavailable.
- Accept temporarily: If operational constraints prevent immediate remediation, document the exposure, rationale, owner, review date, and deadline for mitigation or migration.
Keep the same decision record current as advisories change, packages are updated, and support dates approach. An extension buys time within its stated scope; it does not remove configuration risk or make excluded software supported.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Decide whether to stay on extended support or upgrade
Compare the actual support stream with the cost and risk of moving. A remaining support term is useful only if it covers the components and vulnerabilities that matter to your deployment.
Rank #4
| Decision factor | Questions to answer |
|---|---|
| Term and renewal | When does the current stream end? Is renewal available and sufficiently certain for the time you need? |
| Coverage scope | Are the repositories, packages, modules, and architectures you run included, or will important components remain outside coverage? |
| Vulnerability handling | Which severities qualify? Is a fix guaranteed, or is errata issuance discretionary? How will you handle CVEs that do not qualify? |
| Mitigation options | Can vendor-supported live patching or other controls reduce exposure while you plan a change? What risks remain after mitigation? |
| Change impact | What compatibility, testing, downtime, and operational work would an upgrade require, and what is the risk of postponing it? |
| Uncovered exposure | For how long will any excluded or unfixed component remain exposed, and who owns the mitigation or migration date? |
Use the answers to set a deliberate path: patch covered issues promptly, mitigate or isolate what cannot be patched, and schedule migration where the support window or coverage no longer fits the system’s risk. Review that path whenever the vendor changes lifecycle terms or your entitlement changes.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
