# Ubuntu Pro brings ESM and Kernel Livepatch to AWS Deep Learning GPU instances

> **Key takeaway:** AWS now offers Ubuntu Pro-based Deep Learning AMIs with 10-year security coverage, pinned kernels, and out-of-the-box NVIDIA Grace Blackwell support for enterprise AI workloads.

**Published:** 2026-11-05T13:53:49+00:00 
**Source:** Planet Ubuntu 
**Category:** distro-planet 
**Canonical URL:** https://fosswire.org/news/ubuntu-pro-brings-esm-and-kernel-livepatch-to-aws-deep-learn.html 

## Summary
In September 2026, AWS launched its first Ubuntu Pro-based Deep Learning AMIs in the Base GPU family, giving enterprises running GPU-accelerated AI workloads expanded security maintenance from day one. The images come in four variants spanning Ubuntu 22.04 LTS and 24.04 LTS on both x86_64 and ARM64, with NVIDIA driver 595.91.07 and CUDA toolkits 12.8 through 13.2 preinstalled. Ubuntu Pro's Expanded Security Maintenance extends coverage from Canonical's Main repository to the Universe repository—critical because the base image ships 38 pre-installed Universe packages including OpenMPI, RDMA fabrics, and AMD GPU runtimes—while Kernel Livepatch allows in-memory security updates without rebooting long-running GPU nodes.

The x86_64 images support 14 GPU families from G4dn through Blackwell P6-B200 and P6-B300, while ARM64 covers G5g and the new NVIDIA Grace Blackwell P6e-GB200 and P6e-GB300 instances. AWS pins the kernel for driver compatibility and ships refreshed images weekly or biweekly; the NVIDIA and EFA drivers are compiled against these pinned kernels. Notably, Kernel Livepatch on ARM64 will not be available until Ubuntu 26.04 LTS, leaving a gap for current ARM64 deployments.

## Ubuntu Pro DLAMI image matrix and security model
- **Kernel pinning and driver compilation:** AWS preconfigures GPU images with pinned kernels (6.8.0-1064-aws for 22.04 LTS, 7.0.0-1013-aws for 24.04 LTS) and compiles NVIDIA and EFA drivers against them, shipping security fixes via refreshed images every one to two weeks rather than package updates.
- **CUDA toolkit versioning:** All four image variants ship CUDA 12.8, 12.9, 13.0, and 13.2 with 13.2 set as default, covering both current and near-term NVIDIA software stacks.
- **ESM coverage scope:** Ubuntu Pro extends security maintenance from Main to Universe repositories, covering 38 pre-installed Universe packages including libopenmpi3t64, libfabric1, libucx0, libamdhip64-5, and python3-pip—packages commonly drawn into AI/ML deployments at scale.
- **Grace Blackwell instance support:** Ubuntu Pro 24.04 LTS supports both P6e-GB200 and P6e-GB300 on ARM64; Ubuntu Pro 22.04 LTS supports only P6e-GB200, marking the first AWS DLAMI availability for these NVIDIA Grace Blackwell variants.
- **Kernel Livepatch limitation:** In-memory kernel patching without reboot is available on x86_64 immediately, but ARM64 Kernel Livepatch is deferred to Ubuntu 26.04 LTS, leaving ARM64 GPU instances without this continuity feature for current LTS releases.

## Why it matters
For Linux-based AI infrastructure, this tightens the security model for cloud GPU deployments by bringing Canonical's 10-year support commitment to the package layers that AI/ML pipelines actually depend on, not just the base OS. The pinned-kernel approach trades some flexibility for driver stability, reflecting the operational reality that NVIDIA and EFA driver compilation remains a friction point for administrators maintaining large GPU clusters. The Grace Blackwell support also signals ARM64's growing traction in high-performance AI training, though the Kernel Livepatch gap on ARM64 until 26.04 LTS creates a notable operational asymmetry between architectures.