I'd guess for many patches it'd be trivially easy to determine if they were in or out; for the rest a brute-force search could be done...
Huhwhat? Brute force: A + B + C = D, where D and A are known.
the remaining aggregate of C would be 'redhat patch to 2.6.x-y'.
Huhwhat? Brute force: A + B + C = D, where D and A are known.