Trail of Bits announced a new workflow on November 2, 2026, using Codex to significantly reduce the time required to backport security fixes for stable Linux releases. By October 29, the project delivered fixes for 149 distinct CVEs into stable Linux kernel releases.
Accelerating Backports with Codex
Trail of Bits stated that stable Linux releases often lack security fixes because backporting them is a time-consuming task. To address this, the organization deployed a workflow using Codex and GPT-5.6 to reduce the backporting process time from days to hours per fix.
According to Trail of Bits, the workflow allows AI agents to handle tasks like identifying missing fixes, adapting patches, assembling validation evidence, running tests, and preparing submission packets. Engineers then review the patches and submit them to maintainers.
Impact and Distribution Support
By October 29, the project helped deliver fixes for 149 distinct CVEs into stable Linux kernel releases, alongside several fixes for Fedora and Ubuntu packages. Trail of Bits noted that preparing a straightforward backport takes about 30 minutes of human attention, while more involved cases require around three hours.
Open-source projects and Linux distributions seeking assistance can apply through the Trail of Bits patch website.
What to do
- If you run an open-source project or a Linux distribution and would like help backporting security fixes, please apply at trailofbits.com/patch-the-planet.
Key facts and where they come from
- Trail of Bits is using Codex to reduce the time required for backporting security fixes.
We’re using Codex to reduce the backporting process time from days to hours per fix
- By October 29, the project delivered fixes for 149 distinct CVEs into stable Linux kernel releases.
By October 29, our project helped deliver fixes for 149 distinct CVEs into stable Linux kernel releases
- The organization used Codex with GPT-5.6 to find bug fixes for stable kernel trees.
We used Codex with GPT-5.6 to find these fixes, and asked the maintainers to apply the existing patches.
