Backporting security fixes at scale with Codex

Summary: Trail of Bits used Codex with GPT-5.6 to backport security fixes into stable Linux releases, cutting preparation and review time from days to roughly 30 minutes for a straightforward fix and about three hours for a more involved case. By October 29, the project had delivered fixes for 149 distinct CVEs into stable Linux kernel releases, plus several fixes to Fedora and Ubuntu packages.
Why it matters: About 95% of Ubuntu installations run LTS releases and roughly 96% of installed Debian kernel packages are older stable trees, so the unfixed CVEs in those branches sit on most of the fleet - and the article notes a fix for CVE-2026-98432, a critical remotely exploitable Linux TCP stack flaw, still had not landed in distribution kernels weeks after upstream patching.

Read the original at Trail of Bits Blog ↗