Security Firm Trail of Bits Reports Using Codex to Cut Linux Patch Backporting Time from Days to Hours, Fixing 149 CVEs
Trail of Bits reports leveraging AI agents to drastically reduce human effort in backporting security patches to stable Linux versions, with 149 kernel CVEs fixed as of late October.
US-based cybersecurity consulting firm Trail of Bits published a report on November 2, 2026, stating that it used OpenAI's Codex tool to reduce the human effort required for backporting security fixes to stable Linux versions from days to hours. By October 29, the project had helped deliver fixes for 149 distinct CVEs into stable Linux kernel releases, along with several fixes to Fedora and Ubuntu packages.
Traditionally, adapting security fixes from the latest codebase to older versions is a time-consuming and thankless task, often requiring a week or more of human effort per bug. The new workflow described by Trail of Bits involves AI agents performing activities such as identifying missing fixes, adapting patches, assembling validation evidence, and running tests, while human engineers review the patches and submit them to maintainers. According to the company's self-report, excluding initial setup, preparing and reviewing a straightforward backport now takes about 30 minutes of human attention; more involved cases take around three hours.
This development aims to address the long-standing tradeoff between "stability and security." Data shows that the vast majority of users (e.g., 95% of Ubuntu installations) rely on Long Term Support (LTS) versions, leaving many known vulnerabilities unpatched in stable branches. Trail of Bits notes that as AI-assisted vulnerability hunting becomes more capable, accelerating the security maintenance of these legacy systems has become increasingly urgent.