Remember SETI@home? You gave spare computing power to a good cause. Now put your own Claude to work for open-source security.
Help backport Linux kernel CVE fixes to stable kernels. AI does the heavy lifting. Humans review.
Tip
Contribute with Claude. Open Visual Studio Code with the Claude Code extension. Paste this prompt into the Claude panel:
get https://github.com/armbian/cve and contribute
A kernel CVE fix lands in mainline first. Older stable kernels get it later, and some fixes do not apply to them at all. Devices run these kernels for years.
This repository closes the gap for the LTS kernels 6.1, 6.12 and 6.18, and the newest stable, 7.3. Most fixes apply cleanly and ship automatically. The rest need a backport. That is where your Claude helps.
- Every 15 minutes, a CI job checks the upstream kernel sources for new CVE fixes.
- Fixes that apply cleanly go into the patch set. Every series is build-tested on arm64, arm, riscv and x86.
- Fixes that do not apply go to the open list. Contributors run Claude Code on them, and each backport becomes a pull request.
- A person reviews each backport before it is merged.
- A fix leaves the patch set when the stable kernel carries it.
The prompt in the tip above starts it. Then:
- Claude Code checks your setup and lists the open CVEs.
- You pick the CVEs. Claude makes the backports and reviews them with you.
- Claude asks before it pushes and opens a pull request with only the CVEs you approve.
You need Linux, about 10 GB of free disk space and Claude Code. One CVE takes 1–3 minutes and about $0.30–1.00 of your Claude plan usage.
When are patched kernels released? Beta kernels get the fixes at the next beta build. Stable kernels get them at the weekly stable build, every Monday.
Does Claude write new security fixes? No. Every fix comes from upstream: the kernel CVE records, the stable queue, mainline and the stable mailing list. Claude only adapts an existing fix to an older kernel.
Does Claude work without me? No. Claude runs only when you start it, and only on the CVEs you pick. Nothing is pushed without your approval.
Do I need kernel experience? It helps. You review each backport before you submit it. Leave out a backport that you do not understand, or say so in the pull request. A maintainer reviews it again.
Do I need a board to test on? No. CI builds each patch for four architectures. If you test on a board, name it in the pull request.
Are vendor kernels covered? Not yet. The fixes apply only to kernels built from the stable kernel tree. Armbian images use the 6.18 and 7.3 sets. Vendor kernels from board or SoC vendor trees do not get them.
Is a CVE already covered?
Run ./fasttrack.sh why CVE-2026-1234. It tells you why a CVE is or is not in the patch set.
- Current status per kernel series: report.md
- Latest backport results: cve-report.md
- Patch releases: Releases
- Contribute by hand: CONTRIBUTING.md · Internals and patch usage: DEVELOPMENT.md
- CI status: https://actions.armbian.com/?repo=cve
- Armbian: https://www.armbian.com · Documentation: https://docs.armbian.com