1. Executive summary
Trail of Bits reports that, by October 29, 2026, a Codex-assisted workflow helped deliver fixes for 149 distinct CVEs into stable Linux kernel releases, plus several fixes to Fedora and Ubuntu packages. The work targets the gap between upstream fixes and the older "long term stable" trees that most installations actually run: the firm's own count from the kernel CVE team's vulns.git as of September 18, 2026 lists 2,006 unfixed CVEs in the 5.10.y branch and 1,329 in 6.1.y. The item names one CVE directly, CVE-2026-98432, a critical remotely exploitable flaw in the Linux TCP stack that the firm says had not landed in distribution kernels weeks after the upstream patch; NVD scores it 9.8 critical, it is not in CISA KEV, and EPSS is 0%. For EMEA financial services the exposure is the unpatched stable kernel and distribution packages in production estates, not the backporting tooling itself; the advisory carries no exploitation reporting and no threat actor.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
3. Technical analysis & attack chain
This is a vendor account of a patch-production workflow, not an intrusion. There is no victim, no initial access vector, no malware and no observed exploitation in the item. The attack chain below covers only what the sources establish about the vulnerability the item names and the state of stable-branch patching.
- A flaw is fixed in the latest upstream source. For CVE-2026-98432 the item describes a critical remotely exploitable flaw in the Linux TCP stack, patched upstream.
- The fix is not carried into older stable trees. Trail of Bits states that weeks after the upstream patch, CVE-2026-98432 "still had not landed in distribution kernels."
- Systems running those stable kernels remain exposed to the flaw for as long as the backport is missing.
CVE-2026-98432 is the only CVE the item characterises. NVD scores it 9.8 critical. It is not listed in CISA KEV and EPSS is 0%. The item does not give the affected kernel versions, the vulnerable function, a proof of concept, or any report of exploitation in the wild, and none should be inferred from the "remotely exploitable" description. The item's own framing is that the bug is high-profile enough that it "will soon be fixed everywhere"; that is the author's expectation, not a statement that a fix has shipped.
The scale figures are the substantive technical content. Unfixed CVEs per supported stable branch, from the kernel CVE team's vulns.git as of September 18, 2026, counting CVEs fixed in a newer branch but not in the branch listed:
| Branch | Unfixed CVEs | % with an NVD score | High or critical |
|---|---|---|---|
| 5.10.y | 2,006 | 55.8% | 213 (19.0%) |
| 5.15.y | 1,889 | 51.5% | 195 (20.0%) |
| 6.1.y | 1,329 | 43.9% | 99 (17.0%) |
| 6.6.y | 1,012 | 35.6% | 65 (18.1%) |
| 6.12.y | 686 | 22.3% | 21 (13.7%) |
| 6.18.y | 337 | 15.1% | 3 (5.9%) |
Distribution package counts, compiled by Codex from the Debian and Ubuntu bulk CVE data feeds. The item states these are distro-metadata findings, not individually source-confirmed vulnerabilities, and that the counts both over- and under-count:
| Distribution | Source packages with unfixed CVEs | Unique CVEs | High or critical |
|---|---|---|---|
| Debian 13 | 1,128 | 4,562 | 1,822 (39.9%) |
| Ubuntu 26.04 | 1,028 | 770 | 335 (43.5%) |
The workflow itself: Codex with GPT-5.6 identifies missing fixes, adapts patches that do not apply as-is, assembles validation evidence, runs tests and prepares submission packets; engineers review and submit to maintainers. Trail of Bits states a straightforward backport takes about 30 minutes of human attention to prepare and review, and a more involved case around three hours, excluding project setup. Regression testing and maintainer acceptance remain outside those estimates. The firm says it began with fixes that applied cleanly to stable trees but had never been pulled in, then moved to patches requiring adaptation, starting with the simplest to validate.
Two claims in the item are single-sourced to Trail of Bits and are not corroborated elsewhere in the material provided: the 149-CVE figure and the statement that CVE-2026-98432 had not reached distribution kernels. Both should be verified against the kernel CVE team's tracker and the relevant distribution security trackers before being used in client reporting. The item also references "the recently disclosed OpenAI hack" and an old vulnerability in stable software used as part of it, without naming the vulnerability, the affected software or a source; no technical detail from that reference is carried here.
4. Mitigation & containment
P1 within 24h
- Inventory Linux kernel and distribution package versions across production and container base images, and map each against the distribution security tracker for the release in use. The item gives no fixed kernel version for CVE-2026-98432, so the distribution's own tracker is the authority on whether a backport has shipped for the release in use.
- Where a distribution has shipped a kernel update carrying the CVE-2026-98432 fix, apply it through the normal kernel update path and schedule the reboot. Where it has not, record the exposure and the compensating control in the risk register rather than assuming the upstream patch covers the distribution kernel.
P2 within 72h
- For hosts that cannot take a kernel update on the normal cycle, restrict network reachability to the exposed service at the perimeter and between segments, and raise logging on those flows.
- Pull the unfixed-CVE counts for the specific stable branches in use from the kernel CVE team's vulns.git and from the Debian and Ubuntu bulk CVE feeds, and rank the high and critical entries against services that are internet-facing.
P3 within 7 days
- Set a recurring review of stable-branch backport status for the kernel versions in the estate, so that fixes which land only in newer branches are picked up rather than waiting for the next distribution point release.
- Where the estate runs Debian 13 or Ubuntu 26.04, reconcile the package inventory against the distribution's unfixed-CVE feed and prioritise packages with high or critical entries that are reachable from untrusted networks.
No fixed release for CVE-2026-98432 is named in public reporting beyond the statement that it was patched upstream. No vendor advisory, KB identifier or patch command is given in the item.
5. Indicators of compromise
No indicators of compromise available in the source material.
6. Detection
Insufficient indicators to author detection rules.
CVE assessment
1 referenced CVE — 1 critical (CVSS ≥ 9.0)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-98432 | 9.8 Critical | — | 0% | In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period… |
7. Sources
- Trail of Bits, "Backporting security fixes at scale with Codex", https://blog.trailofbits.com/2026/11/02/backporting-security-fixes-at-scale-with-codex/, 2026-11-02
- Trail of Bits, "Backporting security fixes to stable releases", https://blog.trailofbits.com/2026/10/27/backporting-security-fixes-to-stable-releases/, 2026-10-27
8. Adverse Trace position
Adverse Trace assesses CVE-2026-98432 at CVSS 9.8 critical on the NVD score, not in CISA KEV, with EPSS at 0%; the item reports no exploitation in the wild and no actor, so the client risk is exposure through unpatched stable kernels and distribution packages rather than an active campaign. The 149-CVE figure and the claim that CVE-2026-98432 had not reached distribution kernels are single-sourced to Trail of Bits and should be verified against the kernel CVE team's tracker and the distribution security trackers before use in regulatory or board reporting. We will monitor the kernel CVE team's vulns.git and the Debian and Ubuntu security trackers for the CVE-2026-98432 backport landing in the releases our clients run, and will reissue this advisory if a distribution fix is named or if exploitation is reported.
Published via PulseTrace — Adverse Trace threat intelligence.