Backporting security fixes to stable releases

What it is

A Trail of Bits post (27 October 2026) arguing that stable and LTS software carries known, fixed-upstream CVEs that were never backported. The author says AI agents can exploit such bugs quickly. They cite their own sandbox escape research and an old stable-software vulnerability used in the recently disclosed OpenAI hack. The page gives no detail on either incident.

How it works

The author counts only bugs that have a CVE, are fixed in the latest release, and are missing from the stable package.

• Kernel: the count comes from the kernel CVE team's vulns.git as of 18 September 2026. It lists CVEs per supported stable branch that lack a fix there but have one in a newer branch, so older branches always show more.
• Debian 13 and Ubuntu 26.04: the count covers non-kernel CVEs marked open or affected in each distro's bulk CVE feed, compiled by Codex.

The fix process starts with patches that already apply cleanly to stable kernel trees but were never pulled in. Codex with GPT-5.6 found them, and maintainers were asked to apply them. The team is now moving on to real backports, beginning with the easiest to validate and review. The same approach is being applied to distribution packages: identify the vulnerability, backport a fix, validate it, then send it to the distribution.

Preconditions / Affected

• Anyone on stable kernel branches or on Debian 13 or Ubuntu 26.04 packages.
• The page says about 95% of Ubuntu installs are LTS, and that Debian popcon shows most installed kernels on older stable trees.

What to do

• Project and distribution maintainers can apply for backporting help at trailofbits.com/patch-the-planet.
• The page says everyone should update to the latest software where possible, and should also use mandatory access controls, code integrity checks, sandboxing and privilege separation.
• The page points to a backport tracker listing applied kernel fixes. It currently shows 142 fixes covering 90 CVEs, and the list is still growing.

Caveats

• The author says the kernel counts both over- and under-count because of technicalities, and do not measure exploitability.
• The distro numbers are metadata findings, not source-confirmed vulnerabilities.
• The author chose Debian, Ubuntu and the kernel because they publish CVE accounting, and says other projects lack this transparency.
• The tables with the actual counts are images and are not in the fetched text. The page gives no per-branch or per-distro figures, and no results yet for distribution patches beyond an initial batch.