Backporting security fixes to older Linux releases now takes hours per fix instead of days, the security firm Trail of Bits says, after it put OpenAI’s Codex coding agent to work on the job. By 29 October the project had helped deliver fixes for 149 distinct CVEs into stable Linux kernel releases, plus several fixes for Fedora and Ubuntu packages, Artem Dinaburg wrote on the company’s blog on 2 November.
The work targets a quiet gap in open-source security. A bug is usually fixed first in the newest version of a program, and often only there. Most people and companies run older, long-term stable releases, so a known flaw can stay open on their machines long after the fix exists upstream. Copying that fix back to older code, known as backporting, is slow and mostly unpaid.
In brief
- Trail of Bits uses Codex with GPT-5.6 to find missing security fixes and adapt them to older Linux code; its engineers review and submit every patch.
- It says this cut the work from days to hours per fix and helped get fixes for 149 CVEs into stable Linux kernels by 29 October.
- The speed-up figures are the company’s own, and regression testing and maintainer approval still take time it has not measured.
Codex speeds up backporting security fixes, but engineers sign off every patch
In Trail of Bits’ workflow, AI agents find the missing fixes, adapt the patches to older code, gather evidence that they work, run tests and prepare a submission. Engineers then review each patch and send it to the maintainers who look after each stable branch. The company says a straightforward backport now takes about 30 minutes of human attention, and an involved one around three hours, not counting the initial setup for each project.
It started with the easiest cases. Some fixes for known CVEs applied cleanly to the stable kernel trees but had simply never been pulled in. Trail of Bits “used Codex with GPT-5.6 to find these fixes, and asked the maintainers to apply the existing patches. They did, graciously,” Dinaburg wrote. The team then moved on to fixes that need rewriting before they fit older code.
The kernel’s own history shows that second kind of work. A fix for a flaw in KVM, the Linux virtualisation code, went into the 6.1 stable tree on 2 September with a note from Dinaburg explaining how he adapted it to the older code, and his sign-off as a Trail of Bits engineer alongside that of stable maintainer Sasha Levin. Trail of Bits also runs a public tracker of its kernel backports, which on 30 October listed the same 149 CVEs as delivered.
Distribution work is earlier. In Fedora’s bug tracker, Dinaburg offered a backport for a libvirt flaw on 21 October, and Fedora updates for the package went to testing within a week. In a second case, for the pcre2 library, the maintainer replied that he planned to move the stable releases to a newer version instead, which would make a backport unnecessary.
Trail of Bits counts thousands of unfixed CVEs in stable kernels
To show the size of the backlog, Trail of Bits counted CVEs that have a fix in a newer kernel branch but not in an older supported one, using the kernel CVE team’s data as of 18 September. The company stresses that this is “not an exact bug count” and “not a measure of exploitability”, but “a measuring stick”.
| Stable branch | Unfixed CVEs (ToB count) |
|---|---|
| 5.10.y | 2,006 |
| 5.15.y | 1,889 |
| 6.1.y | 1,329 |
| 6.6.y | 1,012 |
| 6.12.y | 686 |
| 6.18.y | 337 |
The stakes come from how people actually run Linux. Trail of Bits says about 95% of Ubuntu installations are long-term support releases, and about 96% of recently installed kernel packages in Debian’s popularity survey are older stable series. The company warns that AI-assisted bug hunting makes old, known flaws easier to find and exploit, which makes the backlog more urgent.
The bottleneck moves from writing patches to reviewing them
Trail of Bits’ claim is about cost, not genius. Backports were rarely hard to imagine; they were tedious, unpaid and easy to put off. If the human share really drops to half an hour for simple cases, a single engineer can clear work that volunteers never had time for. That is a defensive use of AI that does not depend on finding anything new.
The figures need reading with care. The time savings and the 149 total are the company’s own numbers, and its table of unfixed CVEs is, in its own words, a rough gauge rather than a count of real risk. The pace of review is now the limit. Every patch still lands on a maintainer’s desk, and the pcre2 reply shows maintainers will sometimes prefer their own route.
The project also fits a wider pattern TSN has followed. Bitcoin Core changed its disclosure rules because bugs an LLM can easily find can no longer be kept quiet, and Anthropic says its unreleased model found flaws that were patched before going public. Agencies were given three days to patch the Fragnesia Linux kernel flaw. If AI makes finding bugs cheaper, backporting security fixes has to become cheaper too, or users of older releases are left further behind.
OpenAI’s tools, and a reported deal that is still only talks
Trail of Bits names OpenAI’s Codex and GPT-5.6 as its tools. In October, The Information reported that OpenAI was in early talks to buy Trail of Bits. Neither company has announced a deal, and the blog post does not mention one.
Open-source projects and Linux distributions that want help can apply through Trail of Bits’ “Patch the Planet” page. The next test is the distributions: the company says it has only begun sending its first batch of package patches, and its tracker will show how many are accepted.
Sources
- Trail of Bits (Artem Dinaburg): “Backporting security fixes at scale with Codex”, 2 November 2026
- Linux stable tree: “KVM: x86/mmu: Check write tracking in all address spaces” (6.1.y backport, 09aa68552d25), 2 September 2026
- Trail of Bits: Linux stable CVE backport tracker
- Fedora Bugzilla 2520165: libvirt CVE-2026-18917
- Fedora Bugzilla 2531860: pcre2 CVE-2026-86145
Related stories
- OpenAI Is in Early Talks to Buy Security Firm Trail of Bits, The Information Reports
- Bitcoin Core Ends Waits of Up to a Year for Bugs LLMs Can Easily Find
- Anthropic Says Unreleased AI Found 62 Chrome Flaws, All Now Patched
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
