Backporting security fixes at scale with Codex

What it is

Trail of Bits uses Codex with GPT-5.6 to backport fixes for known CVEs into older software that never received them. By 29 October 2026, 149 distinct CVE fixes had been applied to stable Linux kernel trees. Several fixes had also gone to Fedora and Ubuntu packages, and Trail of Bits had begun sending an initial batch of patches to distributions.

How it works

Agents find missing fixes, adapt patches, run tests, assemble validation evidence and prepare submission packets. Engineers review each patch and submit it to maintainers. The page describes a sequence of increasing difficulty:

1. Fixes that already apply cleanly to a stable tree but were never pulled in. Maintainers accepted these on request.
2. Patches that do not apply as-is, starting with those easiest to validate and review.
3. More complex changes, which the team is moving toward slowly.

Per fix, human effort is about 30 minutes for a straightforward backport and about three hours for a more involved one. The page says this cuts the process from days to hours per fix.

Preconditions / Affected

The backlog is measured only for known CVEs fixed in the latest release but missing from stable packages. The page uses the Linux kernel (per stable branch, from the kernel CVE team's vulns.git as of 18 September 2026), Ubuntu 26.04 LTS and Debian 13. These were chosen because they publish unfixed-CVE accounting. The per-branch and per-distribution counts are in tables that the fetched text does not include.

The page gives one example of a lagging fix: CVE-2026-98432, a critical remotely exploitable flaw in the Linux TCP stack. It had not reached distribution kernels weeks after the upstream patch.

What to do

Maintainers of open-source projects or Linux distributions who want backporting help can apply at trailofbits.com/patch-the-planet. Trail of Bits also keeps a backport tracker listing the applied kernel fixes.

Caveats

• The 30 minute and three hour estimates exclude project-specific initial setup. They cover patch preparation and review only, not regression testing or maintainer acceptance.
• The kernel counts over- and under-count for technical reasons, and they do not measure exploitability.
• The Debian and Ubuntu figures are distro-metadata findings (open or affected status in bulk CVE feeds, compiled by Codex), not source-confirmed vulnerabilities.
• The page gives no failure rate, rejection rate or regression data for the generated backports.