JetPack 4 EOL – how to keep your userspace secure during migration

NVIDIA JetPack 4 reached its end-of-life (EOL) in November 2024, marking the end of security updates for this widely deployed stack. JetPack 4 has driven innovation in countless devices powered by NVIDIA Jetson, serving as the foundation of edge AI production deployments across multiple sectors.

But now, the absence of security maintenance creates risk for businesses with deployed JetPack 4-based deployments. Devices running unmaintained software can quickly become vulnerable to known exploits. This blog will walk through your options for maintaining security with Ubuntu Pro, and outline the path toward modernizing your stack with the certified NVIDIA Jetson Orin series.

What does JetPack 4’s EOL mean for you?

As of November 2024, JetPack 4 is no longer maintained by NVIDIA. This means the end of security updates, bug fixes, and support for all JetPack 4.x versions and corresponding Jetson Linux releases. 

This marks an important shift. JetPack 4 users are now fully responsible for maintaining the security of their own deployments or upgrading to newer JetPack versions. Without vendor-backed updates, maintaining system integrity becomes increasingly difficult, especially for production fleets.

For organizations who wants to continue using JetPack 4 for deployment, this raises two pressing questions:

• What’s the best migration path to a supported, future-proof platform?
• How do you keep existing devices secure in the short term? 

Long term solution: Ubuntu certified with +10 LTS 

Your best long-term path is migration. The Jetson Orin series is the future of AI at the edge – and now comes with official Ubuntu certification.

Canonical and NVIDIA have collaborated to deliver out-of-the-box support for NVIDIA Jetson Orin platforms. Whether you’re using Jetson Orin Nano, Jetson Orin NX, or Jetson AGX Orin, certified Ubuntu brings:

• Unparalleled performance: Harness the full potential of the NVIDIA Jetson platform’s AI capabilities with optimized Ubuntu images.
• Enterprise-ready security: Benefit from Ubuntu’s robust security features and long-term support.
• Seamless development to deployment: Experience a unified environment from cloud to edge, streamlining the AI development process.
• Reliable stability on certified hardware: Canonical’s QA team performs an extensive set of over 500 OS compatibility-focused hardware tests to ensure that every aspect of the system is checked and verified for the best Ubuntu experience.

With Ubuntu on Jetson Orin, developers gain a consistent and modern Linux experience – the same tools used in cloud and desktop environments are now available on the edge. This continuity simplifies development, accelerates time to market, and maximises device lifespan.

Learn more: Ubuntu now officially supports NVIDIA Jetson – powering the future of AI at the edge

Short term solution: Ubuntu Pro and ESM

Immediate migration to Jetson Orin may not be feasible for every team. Legacy deployments, supply constraints, or integration timelines can slow things down.  

JetPack 4 is built upon Ubuntu 18.04 LTS. This Ubuntu userspace includes more than 23,000 packages – such as Python, OpenSSL, systemd, and bash – that are integral to the system’s functionality and your developed application.​ The standard support window for these packages ended in 2023, so they are no longer receiving security maintenance. 

Canonical’s Ubuntu Pro offers Expanded Security Maintenance (ESM) for Ubuntu LTS releases, ensuring continued security updates beyond the standard support window. For JetPack 4 users, enabling Ubuntu Pro gives access to updates from the ESM PPA until 2028, so that packages from the Ubuntu userspace remain secure. 

These updates provide critical security patches for the Ubuntu 18.04 LTS userspace only. The JetPack 4 kernel (based on the Linux kernel 4.9) remains outside of the scope of the service – so migration should still be the long term goal – but ESM can help you maintain operational security and system stability while you transition to newer platforms.

Ubuntu Pro also includes popular applications such as the Robot Operating System (ROS), where Canonical provides services such as ROS ESM for the upcoming EOL of ROS 1 Noetic.

| Remember to always test your updates before deploying them to end devices. 

Small number of devices: purchase ESM through the Ubuntu Pro store

For a few devices, purchasing ESM directly through the Ubuntu Pro Store is straightforward. Simply go to the Ubuntu Pro Store and complete your purchase. 

Go to the Store

Larger fleets: purchase ESM through Canonical’s Ubuntu Pro for Devices

Ubuntu Pro for Devices grants you access to the Ubuntu Pro subscription (and so to ESM), applying a beneficial discount-based model depending on your compute module.

Get in touch with a sales representative to get Ubuntu Pro through our Devices plan.

How to activate ESM

Security updates during ESM are accessed via a dedicated repository. This requires a subscription token, which you can get through your Ubuntu Pro account after subscribing.

To enable ESM, you just need to follow the following instructions in your welcome email: 

1. Install the Ubuntu Pro client
2. Attach your token to your JetPack4 machine
3. Activate ESM 
4. Run apt upgrade will now allow you to install available updates

For more detailed instructions, please visit the official documentation of Ubuntu Pro.

Summary

With JetPack4 EOL, businesses must proactively manage their devices. Working on an unsupported release introduces security risks no organization can afford. Although migrating to a newer Ubuntu Certified Jetson Orin remains our primary recommendation, we acknowledge the challenges involved. When migration isn’t immediately feasible, activating ESM provides some security maintenance.

Get in touch for tailored advice on the best migration or support options for your organization.