Trail of Bits: stable releases ship thousands of unfixed CVEs

01What happened

Artem Dinaburg of Trail of Bits published a measurement of unfixed CVEs in stable software on 27 October 2026. Using CVE data, the post counts known flaws whose fixes exist only in newer branches, across two Linux kernel stable branches, Debian 13 and Ubuntu 26.04. Trail of Bits also reports that maintainers have applied 142 of its backported fixes, covering 90 CVEs, to stable kernel trees.

02How it works

Security fixes usually land in the latest version, and backporting them to older stable branches is manual work that often does not happen, which leaves users choosing between stability and security. Trail of Bits used Codex with GPT-5.6 to find fixes that apply to a given stable branch and to prepare backported patches for maintainer review. The counts come from matching CVE records against the branch each fix reached, and Dinaburg describes them as measuring sticks rather than exact figures.

03Who is affected

Linux kernel branch 5.10.y and Debian 13 carry the largest counts in the post, with Ubuntu 26.04 and kernel branch 6.18.y lower; the per-target numbers are listed below. Anyone running a long-term stable distribution or kernel branch for stability reasons is in scope.

04What to do

Track which CVEs remain unfixed in the stable software you run, and update where updating is possible. Where it is not, Trail of Bits recommends containing bugs with mandatory access controls, code integrity checks, sandboxing and privilege separation. Maintainers can request backporting help through its Patch the Planet program.

Sources 2 links, all fetched

1. 1blog.trailofbits.comTrail of Bits Post
2. 2trailofbits.comPatch The Planet