Linux kernel approaches 2000 vulnerabilities per release – maintainers can't keep up with the flow of AI-generated CVEs

The number of vulnerabilities fixed in each Linux kernel release has crept up close to 2,000, up from roughly 500 during much of the Linux 6.x era. The jump isn't down to sloppier code – it's the result of AI and large language models being turned loose on the operating system's source tree en masse.

Linux stable maintainer Greg Kroah-Hartman flagged the trend with a slide from an upcoming presentation for Kernel Recipes 2026, as Phoronix reported on August 28. The chart shows CVE counts crossing 1,000 with Linux 7.0 and topping 1,500 with Linux 7.2, and if the pace holds, Linux 7.3 could push past 2,000.

The subject matter alone is daunting – 35 years into its existence, the Linux source tree has ballooned to over 40 million lines of code. Automated tools can comb through the most obscure corners of that codebase, sections humans might not touch for years, and they occasionally do turn up real problems. Some CVE entries from this year even credit AI-assisted static analysis with catching vulnerabilities that Intel Product Security later confirmed.

The catch is that much of what these tools flag turns out to be low-priority issues in rarely used driver code, questionable patches, or flat-out hallucinations. Sorting the useful finds from the noise falls squarely on human maintainers.

Networking subsystem maintainer Jakub Kicinski laid out just how much extra work that creates. In his pull request for Linux 7.3, he estimated that between one-third and one-half of the 648 net-next patches handled during the cycle looked like low-priority fixes, clean-ups, or clarifications generated by AI.

Jakub Kicinski, Linux kernel networking subsystem maintainer:

We are completely overwhelmed.

The flood of reports has pushed developers to rethink how much old code is worth keeping around. In April, Andrew Lunn proposed removing roughly 28,000 lines of legacy networking drivers built for ISA and PCMCIA-era hardware. That code used to sit untouched for years because barely anyone used it, but AI scanners and fuzzers started digging up defects in it anyway – defects maintainers are on the hook to investigate and fix regardless of whether the hardware is running anywhere in the wild.

Linux 7.3 is dropping old SGI and IBM driver code from the kernel, and other ancient components face a similar fate as maintainers weigh whether their compatibility value still justifies the upkeep. The FreeVxFS filesystem driver got removed after its maintainer said the decades-old code had basically become target practice for automated bug checkers.

None of this means the kernel community is turning its back on AI outright. Kroah-Hartman himself has used locally run, AI-assisted fuzzing tools to hunt down real kernel bugs. The sticking point is unverified model output getting dumped on humans to sort out.

Kroah-Hartman recently banned LLM-generated patches from the staging subsystem, carving out an exception only for genuine security fixes. Updated guidance for kernel developers also warns that AI-generated reports submitted without human verification just waste maintainers' time.