# Trail of Bits: stable releases ship thousands of unfixed CVEs

> Trail of Bits counted how many known security bugs stay unfixed in stable Linux kernel branches and distribution releases.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Research
- **Published by:** Trail of Bits
- **Disclosed:** 2026-10-27
- **Affects:** Linux kernel, Debian, Ubuntu
- **Research by:** Artem Dinaburg
- **Primary source:** https://blog.trailofbits.com/2026/10/27/backporting-security-fixes-to-stable-releases/
- **Page:** https://theinjection.dev/items/trailofbits-backporting-stable-releases/

Stable releases carry many known, unfixed security bugs, Trail of Bits reports: 4,562 unique CVEs across 1,128 Debian 13 source packages, and 2,006 in the Linux 5.10.y kernel branch. Maintainers applied 142 of its backports.

## What happened

Artem Dinaburg of Trail of Bits published a measurement of unfixed CVEs in stable software on 27 October 2026. Using CVE data, the post counts known flaws whose fixes exist only in newer branches, across two Linux kernel stable branches, Debian 13 and Ubuntu 26.04. Trail of Bits also reports that maintainers have applied 142 of its backported fixes, covering 90 CVEs, to stable kernel trees.

## How it works

Security fixes usually land in the latest version, and backporting them to older stable branches is manual work that often does not happen, which leaves users choosing between stability and security. Trail of Bits used Codex with GPT-5.6 to find fixes that apply to a given stable branch and to prepare backported patches for maintainer review. The counts come from matching CVE records against the branch each fix reached, and Dinaburg describes them as measuring sticks rather than exact figures.

## Who is affected

Linux kernel branch 5.10.y and Debian 13 carry the largest counts in the post, with Ubuntu 26.04 and kernel branch 6.18.y lower; the per-target numbers are listed below. Anyone running a long-term stable distribution or kernel branch for stability reasons is in scope.

## What to do

Track which CVEs remain unfixed in the stable software you run, and update where updating is possible. Where it is not, Trail of Bits recommends containing bugs with mandatory access controls, code integrity checks, sandboxing and privilege separation. Maintainers can request backporting help through its Patch the Planet program.

## Quick facts

- **Linux 5.10.y:** 2,006 unfixed CVEs, 213 high or critical
- **Linux 6.18.y:** 337 unfixed CVEs, 3 high or critical
- **Debian 13:** 4,562 unique CVEs across 1,128 source packages
- **Ubuntu 26.04:** 770 unique CVEs across 1,028 source packages
- **Backports applied:** 142 fixes covering 90 CVEs in stable kernel trees
- **Tooling:** Codex with GPT-5.6

## Sources

1. [Trail of Bits Post](https://blog.trailofbits.com/2026/10/27/backporting-security-fixes-to-stable-releases/)
2. [Patch The Planet](https://trailofbits.com/patch-the-planet)