# Trail of Bits deploys Codex AI agents to backport 149 Linux kernel CVE fixes

> **Key takeaway:** Trail of Bits has used OpenAI's Codex to reduce security patch backporting from days to hours, delivering fixes for 149 distinct CVEs to stable Linux kernel releases by October 29, 2026.

**Published:** 2026-11-02T12:00:00+00:00 
**Source:** Trail of Bits Engineering Blog 
**Category:** cybersecurity 
**Canonical URL:** https://fosswire.org/news/trail-of-bits-deploys-codex-ai-agents-to-backport-149-linux-.html 

## Summary
Trail of Bits has developed an AI-assisted workflow using Codex to automate the labor-intensive process of backporting security fixes to stable Linux releases. By October 29, the project had delivered fixes for 149 distinct CVEs into stable Linux kernel releases, plus additional fixes for Fedora and Ubuntu packages. The workflow divides labor between autonomous agents and human engineers: agents identify missing fixes, adapt patches to older codebases, assemble validation evidence, run tests, and prepare submission packets, while engineers review and submit patches to maintainers.

The effort addresses a systemic problem in open-source maintenance. According to kernel CVE team data from September 2026, even actively maintained stable branches carry hundreds of unfixed CVEs—ranging from 337 on 6.18.y to 2,006 on 5.10.y—with older branches accumulating more unpatched vulnerabilities. Trail of Bits reports that straightforward backports now require approximately 30 minutes of human attention, while complex cases take around three hours, down from days or weeks of often-unrecognized volunteer effort.

## How the Codex backporting workflow operates
- **Agent-human division of labor:** Codex agents handle identification of missing fixes, patch adaptation to older code, dependency checking, validation evidence assembly, test execution, and submission packet preparation; human engineers review patches and submit to maintainers.
- **Time reduction metrics:** Straightforward backport preparation and review takes approximately 30 minutes of human attention; more involved cases require roughly three hours, compared to days or weeks of manual effort.
- **Scope limitations:** The time estimates cover only patch preparation and review; regression testing and maintainer acceptance remain essential steps outside the automated workflow.
- **Backlog quantification:** Kernel CVE team data shows substantial unfixed CVE counts across stable branches, with 5.10.y carrying 2,006 unfixed CVEs (55.8% of tracked vulnerabilities for that branch) and 6.12.y carrying 686 (22.3%).

## Why it matters
This development directly addresses the chronic underinvestment in stable-branch maintenance that leaves the vast majority of Linux deployments—approximately 95% of Ubuntu installations and 96% of Debian kernel packages—running known-vulnerable code. By making neglected backport work economically viable, the Codex workflow could reshape how enterprise and long-term support distributions receive security updates, though its long-term sustainability depends on maintainer acceptance rates and whether similar tooling spreads to other under-resourced open-source projects.