--- title: Backporting security fixes to stable releases | daily.dev description: Stable Linux releases carry thousands of known, unpatched CVEs because security fixes often never get backported from the latest source. Trail of Bits found... canonical: https://daily.dev/posts/backporting-security-fixes-to-stable-releases-3x9riaciu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Backporting security fixes to stable releases | daily.dev og:description: Stable Linux releases carry thousands of known, unpatched CVEs because security fixes often never get backported from the latest source. Trail of Bits found... og:url: https://daily.dev/posts/backporting-security-fixes-to-stable-releases-3x9riaciu og:image: https://api.daily.dev/og/posts/3x9RiACiU.png og:image:alt: Backporting security fixes to stable releases og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Backporting security fixes to stable releases **[Trail of Bits Blog](https://daily.dev/sources/trail-of-bits)** · 6 min read · 0 upvotes · 0 comments ## Summary Stable Linux releases carry thousands of known, unpatched CVEs because security fixes often never get backported from the latest source. Trail of Bits found the Linux kernel's 5.10.y branch has 2,006 unfixed CVEs, while 6.18.y has 337. Debian 13 has 4,562 unique unfixed CVEs across 1,128 packages, and Ubuntu 26.04 has 770 across 1,028 packages. Using Codex with GPT-5.6 to find applicable fixes, the team got maintainers to apply 142 fixes covering 90 CVEs to stable kernel trees, and is offering backporting help to open source projects and Linux distributions via trailofbits.com/patch-the-planet. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How many unfixed CVEs does the Linux kernel 5.10.y stable branch have? The 5.10.y stable branch has 2,006 unfixed CVEs that are patched in a newer kernel branch but missing from 5.10.y, according to a count based on the kernel CVE team's vulns.git data as of September 18, 2026. Of those, 55.8% have an NVD score and 213 (19.0%) are rated high or critical severity. _Teams weighing kernel LTS upgrades can track backport status and CVE counts like these on daily.dev._ ### How many unpatched CVEs are currently in Debian 13 and Ubuntu 26.04 packages? Debian 13 has 4,562 unique unfixed CVEs across 1,128 source packages, with 1,822 (39.9%) rated high or critical severity. Ubuntu 26.04 has 770 unique unfixed CVEs across 1,028 source packages, with 335 (43.5%) rated high or critical. These figures come from each distribution's bulk CVE data feeds, compiled with Codex. _Developers deciding between distros for security posture can follow findings like these on daily.dev._ ### How did Trail of Bits use AI to backport Linux kernel security fixes? Trail of Bits used Codex with GPT-5.6 to find existing fixes for known CVEs that applied cleanly to stable kernel trees but had never been pulled in, then asked maintainers to apply them. Maintainers applied 142 fixes covering 90 CVEs to stable trees, tracked on a public backport dashboard, with Codex and GPT-5.6 also used to find and validate fixes for Linux distribution packages. _Anyone exploring AI-assisted security patching workflows can follow efforts like this on daily.dev._ ## Similar posts on daily.dev - [Debian's latest kernel security update has 1,313 reasons to patch](https://daily.dev/posts/debian-s-latest-kernel-security-update-has-1-313-reasons-to-patch-pj3upxbyo) · The Register · 0 upvotes · 0 comments - [The Linux Kernel Is Approaching 2,000 CVEs Per Release](https://daily.dev/posts/the-linux-kernel-is-approaching-2-000-cves-per-release-vzorlgrlg) · Phoronix · 0 upvotes · 0 comments - [Eight stable kernels with fix for a single vulnerability](https://daily.dev/posts/eight-stable-kernels-with-fix-for-a-single-vulnerability-fwk63qgar) · LWN.net · 0 upvotes · 0 comments - [Linux CVE assignment process](https://daily.dev/posts/linux-cve-assignment-process-8whl1ct57) · Lobsters · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux), [#ubuntu](https://daily.dev/tags/ubuntu) [View this post on daily.dev](https://daily.dev/posts/backporting-security-fixes-to-stable-releases-3x9riaciu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Backporting security fixes to stable releases","url":"https://daily.dev/posts/backporting-security-fixes-to-stable-releases-3x9riaciu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/backporting-security-fixes-to-stable-releases-3x9riaciu"},"datePublished":"2026-10-27T11:04:04.958Z","dateModified":"2026-10-27T11:04:34.632Z","description":"Stable Linux releases carry thousands of known, unpatched CVEs because security fixes often never get backported from the latest source. Trail of Bits found...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0f82598dcabf407fc8c0a30b95cab2dd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0f82598dcabf407fc8c0a30b95cab2dd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Trail of Bits Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Trail of Bits Blog","logo":"https://media.daily.dev/image/upload/s--TLbYx4ip--/f_auto,q_auto/v1780213255/logos/trail-of-bits?_a=BAMAMiWQ0","url":"https://daily.dev/sources/trail-of-bits"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/backporting-security-fixes-to-stable-releases-3x9riaciu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,linux,ubuntu","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Trail of Bits Blog","item":"https://daily.dev/sources/trail-of-bits"},{"@type":"ListItem","position":3,"name":"Backporting security fixes to stable releases"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/backporting-security-fixes-to-stable-releases-3x9riaciu#faq","mainEntity":[{"@type":"Question","name":"How many unfixed CVEs does the Linux kernel 5.10.y stable branch have?","acceptedAnswer":{"@type":"Answer","text":"The 5.10.y stable branch has 2,006 unfixed CVEs that are patched in a newer kernel branch but missing from 5.10.y, according to a count based on the kernel CVE team's vulns.git data as of September 18, 2026. Of those, 55.8% have an NVD score and 213 (19.0%) are rated high or critical severity. Teams weighing kernel LTS upgrades can track backport status and CVE counts like these on daily.dev."}},{"@type":"Question","name":"How many unpatched CVEs are currently in Debian 13 and Ubuntu 26.04 packages?","acceptedAnswer":{"@type":"Answer","text":"Debian 13 has 4,562 unique unfixed CVEs across 1,128 source packages, with 1,822 (39.9%) rated high or critical severity. Ubuntu 26.04 has 770 unique unfixed CVEs across 1,028 source packages, with 335 (43.5%) rated high or critical. These figures come from each distribution's bulk CVE data feeds, compiled with Codex. Developers deciding between distros for security posture can follow findings like these on daily.dev."}},{"@type":"Question","name":"How did Trail of Bits use AI to backport Linux kernel security fixes?","acceptedAnswer":{"@type":"Answer","text":"Trail of Bits used Codex with GPT-5.6 to find existing fixes for known CVEs that applied cleanly to stable kernel trees but had never been pulled in, then asked maintainers to apply them. Maintainers applied 142 fixes covering 90 CVEs to stable trees, tracked on a public backport dashboard, with Codex and GPT-5.6 also used to find and validate fixes for Linux distribution packages. Anyone exploring AI-assisted security patching workflows can follow efforts like this on daily.dev."}}]} ```