Trail of Bits uses Codex to backport Linux security fixes

Security firm Trail of Bits said on 2 November 2026 that it is using OpenAI's Codex coding agent to speed up the backporting of security fixes into older, still-supported versions of Linux. By 29 October 2026, the company said, the project had helped deliver fixes for 149 distinct CVEs into stable Linux kernel releases, along with several fixes to Fedora and Ubuntu packages.

Backporting is the work of moving a fix from the newest version of a piece of software into older versions that people actually run. According to the blog post, it is slow and unglamorous, and often simply never happens. The firm quotes XFS developer Dave Chinner describing the task as effectively a full-time job that goes undone without sufficient resources. Packaging is frequently handled by volunteers who are already stretched, the company said, and only high-profile bugs reliably get fixes pushed back to stable branches.

That matters because most users are on older code. Trail of Bits said about 95% of Ubuntu installations are Long Term Support releases, and that roughly 96% of recently installed kernel packages recorded by Debian's popularity contest statistics are based on older stable trees rather than the latest kernel series. Users therefore face a choice between a familiar stable version with known flaws and a newer version that fixes them but changes other behaviour.

The firm argues the backlog is now a live risk rather than a theoretical one. It said a swarm of AI agents with offensive capability could move quickly through a network of known-vulnerable stable software, and that AI-assisted bug hunting makes old code easier to probe. As an example it cited CVE-2026-98432, described in the post as a critical remotely exploitable flaw in the Linux TCP stack, which it said had still not landed in distribution kernels weeks after being patched upstream. The company also said an old vulnerability in stable software was used as part of the recently disclosed OpenAI hack.

The workflow splits the job between machine and human. Agents identify missing fixes, adapt patches to older code, assemble validation evidence, run tests and prepare submission packets. Engineers then review the patches and submit them to maintainers. Trail of Bits said that, excluding project-specific setup, preparing and reviewing a straightforward backport takes about 30 minutes of human attention, while a more involved case takes around three hours. It said this cuts the process from days to hours per fix.

The company was explicit about the limits of those figures. The estimates cover only patch preparation and review. Regression testing and acceptance by maintainers remain essential and are not included. Adapting a fix to older code also requires checking dependencies and confirming the change has not introduced new bugs, the post said, and a single task such as tracking down a bug in a bad commit can take a week or more.

To size the problem, Trail of Bits counted CVEs that are fixed in a newer kernel branch but not in a given supported stable branch, using the kernel CVE team's vulns.git data as of 18 September 2026. It cautioned that this both over- and under-counts for technical reasons and is not a measure of exploitability, but said it shows a substantial number of known CVEs remain unfixed in stable kernels. The firm said it was not singling out the Linux kernel, Ubuntu 26.04 LTS or Debian 13 Stable, which it described as well run, but chose them because they publish accounting for unfixed CVEs where other projects do not.