AI-powered bug hunting is pushing the Linux kernel towards 2,000 CVEs per release and leaving maintainers buried under the resulting paperwork.
According to Tom’s Hardware Linux stable maintainer Greg Kroah-Hartman highlighted the trend ahead of Kernel Recipes 2026. Linux 6.x releases typically fixed roughly 500 CVEs, while Linux 7.0 passed 1,000 and Linux 7.2 topped 1,500.
If the current rate continues, Linux 7.3 could pass 2,000. The increase does not necessarily mean Linux has suddenly become less secure, but that automated tools are finding far more things to complain about.
The Linux source tree has grown to more than 40 million lines over its 35-year existence. AI and large language models can now rummage through obscure corners of that code which humans may not have touched for years.
Some of the discoveries are genuine. CVE records this year have credited AI-assisted static analysis with finding vulnerabilities later confirmed by Intel Product Security.
Unfortunately for maintainers, the machines produce plenty of rubbish alongside useful results. Reports often involve low-priority bugs in obscure drivers, dubious patches, or outright hallucinations, requiring humans to decide whether anything needs fixing.
Linux networking maintainer Jakub Kicinski said between one-third and one-half of 648 net-next patches during the Linux 7.3 cycle appeared to involve low-priority fixes, clean-ups or clarifications driven by AI.
“We are completely overwhelmed,” Kicinski wrote.
The flood is forcing developers to reconsider how much ancient hardware support deserves indefinite life support. Code which previously sat quietly for years can suddenly become a magnet for automated bug hunters.
Developer Andrew Lunn proposed removing nearly 28,000 lines of legacy networking code in April. The affected drivers covered old ISA and PCMCIA-era hardware with vanishingly small numbers of remaining users.
Linux 7.3 is removing old SGI and IBM driver code, while other elderly components are heading for the skip. The FreeVxFS filesystem driver disappeared after its maintainer concluded it had largely become fodder for automated bug checkers.
The kernel community is not rejecting AI outright. Kroah-Hartman has successfully used locally running AI-assisted fuzzing tools himself, but has barred LLM-generated patches from the staging subsystem except for legitimate security fixes.
Kernel guidance warns that AI-generated reports submitted without human verification can waste maintainer time. Developers have gained access to several frontier models to help review patches and filter hallucinations, while Linux 7.3 entered testing with Linus Torvalds releasing 7.3-rc1 on 30 August.
