Understand this story
Trail of Bits used Codex together with GPT-5.6 to backport security fixes to the stable Linux kernel and to Fedora and Ubuntu packages. As of October 29, it had delivered fixes for 149 CVEs to the stable kernel branches, along with a number of Fedora and Ubuntu package fixes. In the workflow, the agent is responsible for identifying missing fixes, adapting patches, assembling verification evidence, running tests, and preparing submission materials, while engineers are responsible for reviewing and submitting them to maintainers; excluding initial project setup, a simple backport requires about 30 minutes of manual effort, and complex cases about 3 hours. Trail of Bits also noted that regression testing and maintainer acceptance remain necessary steps.
AI-generated from public reports
Latest development · Report
Trail of Bits uses Codex to backport security patches for stable Linux, covering 149 CVEsDevelopments
1 confirmed developments
Trail of Bits uses Codex to backport security fixes for stable Linux
Source:Trail of Bits Blog
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Nov 2
Trail of Bits BlogFirst-partySelected
Trail of Bits uses Codex to backport security patches for stable Linux, covering 149 CVEs
Trail of Bits used Codex together with GPT-5.6 to backport security patches for the stable Linux kernel and distributions. As of October 29, it had delivered fixes for 149 CVEs to stable kernel branches, plus several Fedora and Ubuntu package fixes. In its workflow, the agent identifies missing fixes, adapts patches, assembles verification evidence, runs tests, and prepares submission materials, while engineers review and submit them to maintainers; excluding initial project setup, a simple backport requires about 30 minutes of human effort, and complex cases about 3 hours. The authors also provide the number of CVEs fixed in newer versions but not backported in each stable branch of the Linux kernel and in Debian 13 and Ubuntu 26.04, and note that regression testing and maintainer acceptance remain necessary steps.