THE CHALLENGE

Patch-porting is critical for maintaining security in ecosystems like Android and the Linux kernel, where diverged downstream branches (e.g., Samsung, Xiaomi) complicate updates. Manual patch-porting is slow and error-prone due to codebase divergence, time-intensive adaptation, frequent conflicts, and limited tool support beyond simple git cherry-pick.

Google’s Vanir helps by detecting missing patches using static analysis and OSV data, but it stops short of applying them. Without better automation, systems remain exposed to vulnerabilities for extended periods. Extending Vanir to adapt and apply patches can deliver faster, more accurate, and scalable security updates.