Backporting security fixes at scale with Codex

What it claims

Trail of Bits uses Codex with GPT-5.6 to find security fixes missing from stable software and to prepare backports, which engineers then review and submit to maintainers. The post says this cuts per-fix effort "from days to hours." The authors argue the work matters more now because AI-assisted bug hunting makes old, unpatched code easier to exploit. As an example, they cite CVE-2026-98432, a critical remote flaw in the Linux TCP stack, which had not reached distribution kernels weeks after the upstream fix.

How it works

Agents identify missing fixes, adapt patches, assemble validation evidence, run tests and prepare submission packets. Humans review each patch and send it to maintainers. The kernel work ran in two stages:

1. Find CVE fixes that already apply cleanly to stable trees but were never pulled in, then ask maintainers to apply the existing patches.
2. Backport fixes that do not apply as-is, starting with the easiest to validate and review and moving slowly toward more complex changes.

For distributions, Codex finds known vulnerabilities in shipping stable packages, then backports and validates fixes. The first batch of distro patches has only just been sent out.

Evidence

The unfixed-CVE counts for the kernel come from the kernel CVE team's vulns.git as of 18 September 2026. They count CVEs fixed in a newer branch but not in the given one. The Debian 13 and Ubuntu 26.04 counts come from each distro's bulk CVE data feeds, compiled by Codex. The page text does not include the table values. The post also states that about 95% of Ubuntu installations are LTS.

How to use it

Open-source projects and Linux distributions can ask Trail of Bits for backporting help at trailofbits.com/patch-the-planet. The post does not publish the agent workflow, prompts or tooling.

Limits

The 30-minute and three-hour figures exclude project-specific initial setup, regression testing and maintainer acceptance. The authors call the CVE counts a "measuring stick," not an exact bug count. They say the counts both over- and under-count and do not measure exploitability. The distro figures are metadata findings, not individually source-confirmed vulnerabilities. The post reports no regression rate and no rejection rate for submitted patches.