Trail of Bits uses Codex to speed up backporting security fixes to stable Linux releases
- Severity
- Medium
- Highest CVSS
- 9.8
- Exploited
- Not known
- Sources
- 3
What happened
Trail of Bits reports that a Codex-based workflow helped deliver fixes for 149 distinct CVEs into stable Linux kernel releases by 29 October, plus fixes to Fedora and Ubuntu packages, with about 30 minutes of human review for a straightforward backport and about three hours for complex ones. CVE-2026-98432, a critical remotely exploitable flaw in the Linux TCP stack, had not reached distribution kernels weeks after upstream patching. Using the kernel CVE team's vulns.git as of 18 September 2026, the authors show many CVEs fixed in newer branches but missing from older stable branches. Defenders should confirm whether their distribution kernels include the TCP fix and prioritise vendor updates for stable branches.
For security analysts · Written by AI from 3 sources · Wrong?
What to do
- Check whether your distribution kernel includes the upstream fix for CVE-2026-98432 and apply the vendor update once it is released.
- Apply stable kernel and distribution security updates promptly rather than relying on the latest upstream version alone.
Written by AI from the sources, checked against them