Backporting Security Patches

Updated

October 30, 2026

Backporting Security Patches

In a stable operating system distribution, when a critical Common Vulnerabilities and Exposures (CVE) identifier is announced in an upstream project, you cannot simply update to the latest upstream release if it introduces breaking API changes. Instead, maintainers must backport the security patch.

+-----------------------------------------------------------+
|                   Backporting Workflow                    |
|                                                           |
| 1. Upstream Project fixes CVE-2024-XXXXX in v3.2.0        |
|    - Commit: 9a4f21bc ("Fix buffer overflow in parse_url")|
|                               |                           |
|                               v                           |
| 2. Distro Maintainer inspects current stable package (v3.0.4)
|    - Identifies code differences between v3.0.4 and v3.2.0 |
|                               |                           |
|                               v                           |
| 3. Cherry-Pick & Adapt Patch (`git cherry-pick -x`)       |
|    - Adjust line numbers, variable renames, and context   |
|    - Resolve merge conflicts cleanly                      |
|                               |                           |
|                               v                           |
| 4. Security Regression Test Suite                         |
|    - Verify that proof-of-concept exploit is mitigated    |
|    - Verify that existing test suite passes 100%          |
|                               |                           |
|                               v                           |
| 5. Release Security Advisory (BYOL-SA-2026-0042)          |
|    - Publish patched package: v3.0.4-1+deb12u1            |
+-----------------------------------------------------------+

Practical Backporting Walkthrough

Suppose upstream curl releases a patch fixing a critical heap corruption vulnerability in commit a8f9c12.

Step 1: Export the Upstream Patch

$ git clone https://github.com/curl/curl.git
$ cd curl
$ git format-patch -1 a8f9c12 -o /tmp/patches/

Step 2: Apply to Distro Recipe Source

Inside your distribution’s package build directory:

$ cd curl-8.5.0
$ patch -Np1 --dry-run -i /tmp/patches/0001-fix-heap-corruption.patch

If the patch applies cleanly without rejects (.rej), add the patch file to your BYOLBUILD recipe’s source array and bump the package release number:

pkgver="8.5.0"
pkgrel=2  # Bumped for security patch!

Step 3: Resolving Patch Rejects

If the patch fails with Hunk #1 FAILED at 142: - Inspect 0001-fix-heap-corruption.patch.rej to view the rejected lines. - Open the offending C file and review the surrounding context: upstream may have refactored a function signature or added new fields in intermediate releases. - Manually edit the patch to match your version’s exact code context.