Understand this story
Trail of Bits points out that a large number of known CVE fixes only make it into the latest versions and are not backported to LTS stable branches, while about 95% of Ubuntu installations use LTS. As of September 18, 2026, the Linux kernel 5.10.y has 2,006 unfixed CVEs, and Debian 13 and Ubuntu 26.04 have 1,822 and 335 unfixed vulnerabilities, respectively. The team used Codex together with GPT-5.6 to identify fixes that can be applied directly and asked maintainers to merge them.
AI-generated from public reports
Latest development · Report
Trail of Bits: Why security fixes are rarely backported to stable versionsDevelopments
1 confirmed developments
Trail of Bits uses Codex and GPT-5.6 to find stable kernel fixes awaiting backport
Source:Trail of Bits Blog
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Oct 27
Trail of Bits BlogFirst-party
Trail of Bits: Why security fixes are rarely backported to stable versions
Trail of Bits points out that a large number of known CVE fixes only make it into the latest version and are not backported to LTS stable branches, while about 95% of Ubuntu installations use LTS. As of September 18, 2026, the Linux kernel 5.10.y has 2006 unfixed CVEs, and Debian 13 and Ubuntu 26.04 have 1822 and 335 unfixed vulnerabilities respectively. The team used Codex together with GPT-5.6 to identify fixes that could be applied directly and asked maintainers to merge them.