The Linux kernel is on track to reach nearly 2,000 CVEs fixed per release, a sharp climb from the roughly 500 that were typical throughout much of the Linux 6.x era. The driving force is not a decline in security or a wave of new flaws, but the growing use of AI and large language models to scan the operating system’s massive codebase for vulnerabilities.
Stable kernel maintainer Greg Kroah-Hartman highlighted the trend in a slide previewing an upcoming talk at Kernel Recipes 2026. The data shows CVE counts crossing 1,000 with Linux 7.0 and topping 1,500 with Linux 7.2. If the current pace holds, Linux 7.3 could push the total past 2,000.
The kernel has grown to more than 40 million lines of code across 35 years of development. AI-powered tools can inspect countless obscure sections that human developers rarely revisit, and they occasionally surface genuine defects. Linux CVE records this year already credit AI-assisted static analysis with identifying vulnerabilities later confirmed by Intel Product Security.
Maintainers Say They Are ‘Completely Overwhelmed’
Many of the AI-generated findings, however, involve low-priority vulnerabilities in obscure driver code, questionable patches, and outright hallucinations. That leaves human maintainers to sort useful work from noise. In the Linux 7.3 networking pull request, maintainer Jakub Kicinski estimated that between one-third and one-half of the 648 net-next patches handled during the cycle appeared to be low-priority fixes, cleanups, or clarifications driven by AI. “We are completely overwhelmed,” Kicinski wrote.
The influx has also prompted maintainers to reconsider whether decades-old drivers are worth keeping. In April, developer Andrew Lunn proposed removing nearly 28,000 lines of legacy networking code covering old ISA and PCMCIA-era hardware. These drivers once demanded little attention because they had almost no users, but AI and fuzzing tools began flagging defects that maintainers were obligated to investigate regardless of whether anyone still ran the hardware.
Linux 7.3 is dropping old SGI and IBM driver code, and other aging components have been retired as maintainers weigh compatibility value against rising maintenance costs. The FreeVxFS filesystem driver, for instance, was removed after its maintainer said the decades-old compatibility code mostly served as material for automated bug checkers.
Fighting AI With AI
The kernel community is not rejecting AI outright. Kroah-Hartman himself has used locally running AI-assisted fuzzing tools to find kernel bugs. The friction centers on unverified AI output handed to humans for validation. Kroah-Hartman recently barred LLM-generated patches from the kernel’s staging subsystem except for legitimate security fixes, and updated kernel guidance now warns that AI-generated reports submitted without human verification can waste maintainer time.
To keep up, the team is increasingly countering AI with AI. It has secured access to multiple frontier models to help review patches and fil
Source
Image: tomshardware.com
