Abstract:
The number of CVE vulnerabilities fixed in each version of the Linux kernel is rising rapidly, and may exceed 2,000 starting from Linux 7.3. Compared with the long-term maintenance of about 500 vulnerabilities in the Linux 6.x era, this number has exceeded 1,000 in Linux 7.0 and exceeded 1,500 in Linux 7.2.
The maintainer pointed out that the surge in the number of vulnerabilities does not necessarily mean that Linux itself has become more insecure. The main reason is that artificial intelligence and large language models have begun to scan Linux kernel code on a large scale. After 35 years of development, the Linux project has exceeded 40 million lines of code. Automated tools can check unpopular areas that human maintainers rarely revisit, so some real defects have indeed been discovered. Some Linux vulnerability records this year have been clearly noted, and related issues were discovered by AI-assisted static analysis and later confirmed by Intel's product security team.
However, the quality of a large number of AI scan results is uneven, many of which are low-priority issues and concentrated in rarely used drivers; some patches are controversial or even completely AI "hallucinations." Maintainers had to decide on a case-by-case basis which reports were worth processing and which were just noise, resulting in a significant increase in the workload of the kernel team.
During the Linux 7.3 network subsystem development cycle, maintainer Jakub Kicinski said that about one-third to half of the 648 net-next patches appeared to be only low-priority fixes, code cleanups, or descriptive changes driven by AI. He bluntly said that the maintenance team has been "completely overwhelmed."
The additional burden brought by AI has also prompted developers to re-evaluate whether some old drivers that have been around for many years still have value. In April this year, developer Andrew Lunn proposed removing about 28,000 lines of legacy network code, which mainly serves older hardware from the ISA and PCMCIA eras. In the past, these drivers usually required little maintenance because they had few users; but now AI scanners and fuzz testing tools are constantly discovering problems, and maintainers are still obliged to investigate and fix them even if they confirm that no one is using the relevant hardware anymore.
Linux 7.3 has begun to remove some old SGI and IBM drivers, and other ancient components are also undergoing the same review. Maintainers are weighing whether the compatibility value of this code is enough to offset the increasing maintenance costs. For example, the FreeVxFS file system driver has been removed, and its maintainers believe that this set of code, which was retained decades ago for compatibility with older systems, is now mainly a scanning target for automated vulnerability checkers.
The Linux kernel community does not completely reject AI. Linux stable version maintainer Greg Kroah-Hartman himself has successfully used a locally running AI-assisted fuzz testing tool to discover kernel vulnerabilities. The focus of the dispute is that AI output without manual verification is directly handed over to the maintainer for processing. Kroah-Hartman recently banned submission of patches generated by large language models in the kernel staging subsystem, except for true security fixes. The updated kernel development guide also reminds that AI-generated reports without manual verification may waste a lot of maintainers' time.
Faced with this situation, the kernel team began to try to "use AI to fight AI." Currently, the team has obtained access to multiple cutting-edge models to review patches and filter out false results generated by AI. It is also considering letting large language models take on more daily management work.
Kroah-Hartman is expected to discuss this trend further at the Kernel Recipes 2026 conference in Paris from September 21 to 23. Linux 7.3 is currently in beta, with Linus Torvalds releasing Linux 7.3-rc1 on August 30 after a two-week merge window.
Comments