--- title: Backporting security fixes at scale with Codex | daily.dev description: Trail of Bits is using Codex with GPT-5.6 to speed up backporting security fixes into stable Linux releases. By October 29, the project helped land fixes for... canonical: https://daily.dev/posts/backporting-security-fixes-at-scale-with-codex-kyr3rvh9d twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Backporting security fixes at scale with Codex | daily.dev og:description: Trail of Bits is using Codex with GPT-5.6 to speed up backporting security fixes into stable Linux releases. By October 29, the project helped land fixes for... og:url: https://daily.dev/posts/backporting-security-fixes-at-scale-with-codex-kyr3rvh9d og:image: https://api.daily.dev/og/posts/kyr3rVH9D.png og:image:alt: Backporting security fixes at scale with Codex og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Backporting security fixes at scale with Codex **[Trail of Bits Blog](https://daily.dev/sources/trail-of-bits)** · 7 min read · 0 upvotes · 0 comments ## Summary Trail of Bits is using Codex with GPT-5.6 to speed up backporting security fixes into stable Linux releases. By October 29, the project helped land fixes for 149 distinct CVEs into stable Linux kernel releases, plus several fixes to Fedora and Ubuntu packages. Preparing and reviewing a straightforward backport takes about 30 minutes of human attention, while a more involved case takes around three hours. Agents identify missing fixes, adapt patches, assemble validation evidence and prepare submission packets; engineers review and submit to maintainers. As of September 18, the Linux kernel's 5.10.y branch had 2,006 CVEs without a fix in that branch but with one in a newer branch. Debian 13 has 1,128 source packages with unfixed CVEs and 4,562 unique CVEs, based on distro metadata rather than source-confirmed findings. Trail of Bits is inviting other open-source projects and distros to request help via trailofbits.com/patch-the-planet. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How many unfixed CVEs are there in the Linux kernel's 5.10.y stable branch? There are 2,006 unfixed CVEs in the Linux 5.10.y stable branch as of September 18, 2026, according to the kernel CVE team's vulns.git data. Of these, 55.8% have an NVD score, and 213 (19.0%) are rated High or Critical severity. Newer branches have fewer unfixed CVEs: 6.18.y has only 337. _Teams triaging kernel CVE backlogs can track fixes like these on daily.dev._ ### How long does it take to backport a security fix using Codex compared to manual backporting? A straightforward backport using Codex takes about 30 minutes of human attention for preparation and review, compared to a week or more of unseen effort previously required per fix. A more involved backport takes around three hours. This excludes project-specific initial setup, regression testing, and maintainer acceptance, which remain separate steps. _Developers weighing AI-assisted workflows for security maintenance can follow results like this on daily.dev._ ### How many unfixed CVEs exist in Debian 13 and Ubuntu 26.04 stable packages? Debian 13 has 4,562 unique unfixed CVEs across 1,128 source packages, with 1,822 (39.9%) rated High or Critical severity. Ubuntu 26.04 has 770 unique unfixed CVEs across 1,028 source packages, with 335 (43.5%) rated High or Critical. These figures come from each distro's bulk CVE data feeds, compiled with Codex. _Engineers deciding which distro's patch backlog to prioritize can track figures like these on daily.dev._ ## Similar posts on daily.dev - [Backporting security fixes to stable releases](https://daily.dev/posts/backporting-security-fixes-to-stable-releases-3x9riaciu) · Trail of Bits Blog · 0 upvotes · 0 comments - [Debian's latest kernel security update has 1,313 reasons to patch](https://daily.dev/posts/debian-s-latest-kernel-security-update-has-1-313-reasons-to-patch-pj3upxbyo) · The Register · 0 upvotes · 0 comments - [The Linux Kernel Is Approaching 2,000 CVEs Per Release](https://daily.dev/posts/the-linux-kernel-is-approaching-2-000-cves-per-release-vzorlgrlg) · Phoronix · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux), [#ai-agents](https://daily.dev/tags/ai-agents), [#openai-codex](https://daily.dev/tags/openai-codex) [View this post on daily.dev](https://daily.dev/posts/backporting-security-fixes-at-scale-with-codex-kyr3rvh9d) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Backporting security fixes at scale with Codex","url":"https://daily.dev/posts/backporting-security-fixes-at-scale-with-codex-kyr3rvh9d","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/backporting-security-fixes-at-scale-with-codex-kyr3rvh9d"},"datePublished":"2026-11-02T12:07:41.248Z","dateModified":"2026-11-02T12:08:11.890Z","description":"Trail of Bits is using Codex with GPT-5.6 to speed up backporting security fixes into stable Linux releases. By October 29, the project helped land fixes for...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/780ca35e45e65402357a2526c2d25de5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/780ca35e45e65402357a2526c2d25de5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Trail of Bits Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Trail of Bits Blog","logo":"https://media.daily.dev/image/upload/s--TLbYx4ip--/f_auto,q_auto/v1780213255/logos/trail-of-bits?_a=BAMAMiWQ0","url":"https://daily.dev/sources/trail-of-bits"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/backporting-security-fixes-at-scale-with-codex-kyr3rvh9d","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,linux,ai-agents,openai-codex","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Trail of Bits Blog","item":"https://daily.dev/sources/trail-of-bits"},{"@type":"ListItem","position":3,"name":"Backporting security fixes at scale with Codex"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/backporting-security-fixes-at-scale-with-codex-kyr3rvh9d#faq","mainEntity":[{"@type":"Question","name":"How many unfixed CVEs are there in the Linux kernel's 5.10.y stable branch?","acceptedAnswer":{"@type":"Answer","text":"There are 2,006 unfixed CVEs in the Linux 5.10.y stable branch as of September 18, 2026, according to the kernel CVE team's vulns.git data. Of these, 55.8% have an NVD score, and 213 (19.0%) are rated High or Critical severity. Newer branches have fewer unfixed CVEs: 6.18.y has only 337. Teams triaging kernel CVE backlogs can track fixes like these on daily.dev."}},{"@type":"Question","name":"How long does it take to backport a security fix using Codex compared to manual backporting?","acceptedAnswer":{"@type":"Answer","text":"A straightforward backport using Codex takes about 30 minutes of human attention for preparation and review, compared to a week or more of unseen effort previously required per fix. A more involved backport takes around three hours. This excludes project-specific initial setup, regression testing, and maintainer acceptance, which remain separate steps. Developers weighing AI-assisted workflows for security maintenance can follow results like this on daily.dev."}},{"@type":"Question","name":"How many unfixed CVEs exist in Debian 13 and Ubuntu 26.04 stable packages?","acceptedAnswer":{"@type":"Answer","text":"Debian 13 has 4,562 unique unfixed CVEs across 1,128 source packages, with 1,822 (39.9%) rated High or Critical severity. Ubuntu 26.04 has 770 unique unfixed CVEs across 1,028 source packages, with 335 (43.5%) rated High or Critical. These figures come from each distro's bulk CVE data feeds, compiled with Codex. Engineers deciding which distro's patch backlog to prioritize can track figures like these on daily.dev."}}]} ```