149 kernel CVE fixes, backported with an AI agent

Trail of Bits, the security firm best known in crypto for its smart contract audits, has turned to a different backlog: security fixes that never reach the stable software most people run. Using Codex, it says it has cut the time to backport a fix from days to hours, and by 29 October the project had delivered fixes for 149 distinct CVEs into stable Linux kernel releases, along with several fixes to Fedora and Ubuntu packages.

The problem is structural. A fix usually lands in the newest version first, and often only there, because carrying it back to older releases is slow, thankless work frequently left to volunteers. Yet users overwhelmingly run older code: Trail of Bits cites about 95 percent of Ubuntu installations being Long Term Support releases, and about 96 percent of recently installed kernel packages in Debian's popularity data being older stable series rather than the latest.

In the workflow, agents identify missing fixes, adapt patches to older code, gather validation evidence, run tests and prepare submission packets, while engineers review the patches and submit them. Excluding initial setup, a straightforward backport takes about 30 minutes of human attention and a more involved case around three hours; regression testing and maintainer acceptance come on top. The team started with fixes for known CVEs that applied cleanly to stable kernel trees but had simply never been pulled in, then moved to patches that need adapting, and has begun sending a first batch to Linux distributions.

The motivation is explicitly about AI on the other side. The post warns that cyber-capable AI agents make it easier to find and exploit known flaws in older code, so the unfixed backlog in stable releases matters more than it used to. Trail of Bits invites open-source projects and distributions that want help with backports to apply through its Patch the Planet page.