Linux kernel maintainers are facing an unprecedented wave of security bug reports driven by automated AI programming, with ZDNET reporting an average of 27 Common Vulnerabilities and Exposures daily through November 2.
The sheer volume of incoming reports has exposed a critical bottleneck in open-source development. Finding software flaws has become remarkably fast, but reviewing and patching them remains an entirely human task.
The Linux Common Vulnerabilities and Exposures team tracked 27 CVEs a day through Nov. 2 of this year. That high-water mark illustrates a fundamental architectural reality of the operating system.
Linux runs infrastructure ranging from smartphones to supercomputers. Because of this massive footprint, what functions as an isolated bug in one hardware configuration can manifest as a critical security vulnerability in another.
The relentless influx of automated code submissions has pushed veteran contributors to their breaking point. On Nov. 10, ARM engineer and Linux kernel maintainer Lorenzo Stoakes gave up reviewing code.
Stoakes had maintained the memory-management core, misc, reclaim, and Rust-related sections of the kernel. He pointed directly to the degradation in code quality arriving from automated generators.
“Given the current throughput in the kernel resulting from AI-generated series, I unfortunately lack the bandwidth to generally be able to offer review except in those areas I maintain,” Stoakes wrote, according to ZDNET.
Stoakes added that the situation had steadily deteriorated over time. “Of course the AI wave has been horrible, and is getting significantly worse. At first it was once in a while that I’d see slop. Then it was at least once a week. Then every few days. Nowadays it’s pretty much half of what I see, if not more.”
Other core leaders share this assessment of systemic exhaustion. Greg Kroah-Hartman, the Linux kernel stable maintainer, addressed the crisis during a Q&A session at Open Source Summit Europe.
“We don’t have enough people to review them, the onslaught of the LLM-generated patches,” Kroah-Hartman said, as reported by ZDNET. “We need more reviewers. We don’t have enough. All of the maintainers are burnt out, and we have been for ten years.”
Linux creator Linus Torvalds noted in a recent Linux Kernel Mailing List message that much of the new code in the Linux 7.4 rc 2 release was driven by AI fixes.
Torvalds pointed out that on the Berkeley Packet Filter side, fixes are arriving faster than new reports. He cautioned that most other areas have not reached that threshold yet, calling it a sign that the tide may be turning.
Kroah-Hartman remains considerably less optimistic about a rapid turnaround. He said that the ecosystem is getting closer to parity but declined to offer a timeline for when human-approved AI fixes will outpace incoming reports.
Daniel Steinberg, creator of the open-source cURL project, offered a similarly cautious outlook on managing the incoming volume. Steinberg told ZDNET that he believes developers manage the flood well overall, despite periodic fluctuations depending on who sends new findings each week.
Engineering teams still face an arduous road ahead as automated scanners uncover historical flaws. Microsoft’s FORGE Lab recently reported that its MDASH AI scanning system uncovered 59 upstream Linux kernel bug reports, including one security flaw at least 21 years old.
