Confidential computing is moving quickly.

The foundation is already here: AMD SEV-SNP and Intel TDX have made it possible to run confidential virtual machines (VMs) with stronger protection for data in use. Ubuntu 26.04 Long Term Support (LTS) brings integrated host and guest support for both of these technologies, making confidential computing a native  part of the Ubuntu virtualization offering..

However, The next wave of features is still being developed and upstreamed. Live migration for confidential VMs, trusted device assignment, accelerator support, improved attestation flows, and technologies such as the TEE Device Interface Security Protocol (TDISP) will all require changes across the virtualization stack. These features do not depend on one component alone; they need support across the kernel, KVM, QEMU, libvirt, OVMF, and the surrounding tooling before anyone can actually make use of them.

That creates a challenge for any enterprise Linux distribution: production environments want LTS stability, but hardware innovation does not wait two years. How do we solve it?

Enabling newer hardware on LTS releases 

Ubuntu LTS releases are designed for production: they give organizations a stable base, a predictable lifecycle, and long-term security maintenance. Those features are exactly why enterprises use them for critical infrastructure.

However, virtualization is closely tied to hardware. When CPU vendors add new capabilities, the software stack has to evolve with them. For confidential computing, that stack includes the kernel and KVM, QEMU, libvirt, firmware such as OVMF, and management tooling. 

This is important, because confidential computing features rarely arrive on all of the relevant components at once. For instance, a processor may support a capability before the kernel has all the interfaces needed to expose it: QEMU may need new support to model the feature, libvirt may need new abstractions so users can configure it without writing complex QEMU command lines, OVMF may need changes so confidential guests can boot correctly, and attestation components may need to mature so workloads can prove where, and how, they are running. Only when these pieces line up does the feature actually become usable.

Before Ubuntu 26.04 LTS, Ubuntu already had a Hardware Enablement model for the kernel. This is a core part of confidential computing enablement: it includes KVM support, memory-management changes, CPU feature enablement, and the low-level interfaces that confidential virtual machines depend on.

But the kernel is only one layer. If the kernel moves forwards while QEMU, libvirt or firmware remain too far behind, users can still be blocked from using new virtualization capabilities end to end. Confidential computing makes this especially visible because the feature boundary crosses several layers at once.

That is why a traditional LTS model can be difficult for fast-moving virtualization features. If users have to wait for the next LTS to get newer virtualization components, they may be forced to choose between platform stability and access to new hardware capabilities.

For confidential computing, that trade-off is not ideal. The technology is becoming more relevant to regulated workloads, AI infrastructure, sovereign clouds, financial services, and sensitive data processing. The users in these scenarios need stability, but they also need access to the features that make new hardware useful.

Introducing the virtualization HWE stack

Ubuntu 26.04 LTS introduces a HWE stack for virtualization.

The idea is simple: stay on Ubuntu LTS, but have the option to use newer virtualization components as they become available and validated.

The virtualization HWE stack includes:

• qemu-hwe, for hypervisor and system emulation
• libvirt-hwe, for virtualization management
• edk2-hwe, including OVMF firmware, for UEFI support
• seabios-hwe, for BIOS firmware compatibility

This extends HWE beyond the kernel. Instead of only enabling newer hardware through the kernel, Ubuntu can now also move the key virtualization components that are needed to expose, configure and operate that hardware in virtualized environments.

The model works as a rolling enablement window inside the LTS lifecycle. During the first two years of the Ubuntu LTS, the virtualization HWE stack is upgraded every six months to match the latest upstream versions supported in Ubuntu. In practice, that means the stack can follow the cadence of Ubuntu interim releases, while still giving users an LTS base.

The timing is deliberate, as new versions are not pushed into the LTS immediately. They are introduced after they have already been exercised in interim Ubuntu releases, giving time for validation before they reach LTS users.

This gives users a better balance: the operational confidence of an LTS release, with a path to newer virtualization capabilities when they need them.

What is the rolling model? 

The rolling model is important because hardware enablement is not a one-time event. A new confidential computing feature may land upstream in stages. First, kernel support may appear. Then QEMU support follows. Then libvirt adds a way to configure it properly. Firmware support may mature later. Tooling and documentation may come after that. For users, the feature only becomes useful when enough of that chain is present in the distribution.

A six-month HWE cadence gives Ubuntu a way to pick up that work regularly, without turning the LTS into an uncontrolled rolling release. This is the key balance: the base OS remains an LTS, but the virtualization stack has a supported path to move forward during the period when hardware enablement is changing fastest.

For confidential computing, that is essential. Features such as confidential VM live migration, trusted I/O, trusted device assignment, and accelerator enablement will mature over several upstream cycles. A rolling HWE model gives Ubuntu a mechanism to bring those capabilities to LTS users as the stack matures, rather than making them wait for the next LTS release.

Opt-in by design

The virtualization HWE stack is opt-in: existing systems continue to use the base virtualization stack, unless the user explicitly chooses the HWE stack. For organizations that prioritize minimal change, the base stack remains the default. For users who need newer hardware enablement, the HWE stack provides a supported path.

Ubuntu also provides the ubuntu_virt_helper tool to help users manage the stack as a unit. That is important, because virtualization is not one package; it is a set of components that need to move together. Switching only one component can leave a system in an incomplete or inconsistent state.

What does the HWE stack mean for Ubuntu users?

For users building confidential computing environments, the virtualization HWE stack means they do not need to choose between two bad options: they do not need to leave LTS just to access newer virtualization capabilities. They also do not need to wait for the next LTS before they can benefit from features that are already moving through the upstream stack.

Instead, they can stay on Ubuntu 26.04 LTS and opt into a newer virtualization stack when their hardware, workload or feature requirements demand it.

This is especially relevant for organizations working on:

• Confidential VMs with AMD SEV-SNP or Intel TDX
• Regulated workloads that require stronger isolation
• AI workloads that need confidential inference or accelerator support
• Private cloud and sovereign cloud platforms
• Infrastructure that needs long-term maintenance, without falling behind hardware capabilities

For these users, the operating system is not just a place where workloads run. It is the layer that turns hardware capabilities into something usable, maintainable and supportable.

Why Ubuntu can stay ahead

Confidential computing will continue to evolve over the next several years.

The industry still has work to do around live migration, trusted I/O, accelerator enablement, attestation, orchestration, and operational tooling. These features will not become real for users the moment they appear in a processor specification. They become real when the full software stack supports them.

The virtualization HWE model gives Ubuntu a structured way to bring new virtualization capabilities into the LTS lifecycle, without forcing users onto interim releases. It also gives Canonical a way to support the pace of confidential computing development while preserving the qualities that make Ubuntu LTS useful in production.

With Ubuntu 26.04 LTS and the new virtualization HWE stack, Ubuntu is better positioned to remain a leading platform for confidential computing as the technology continues to mature.

Learn more

Confidential computing

How Ubuntu enables verifiable private AI with confidential computing on bare metal

Sovereign clouds: enhance data security with confidential computing