AI-driven vulnerability scans push Linux kernel CVE counts to unprecedented levels, straining maintainers
The Linux kernel is approaching 2,000 fixed vulnerabilities per release, up from roughly 500 in the 6.x era, as AI tools scan its 40-million-line codebase. Many findings are low-priority or false positives, leaving human maintainers to sift through the noise. Kernel developers report that a significant share of recent patches are AI-driven cleanups, adding to the workload.
The surge in CVE numbers reflects a shift in how the kernel is audited, not a sudden decline in code quality. Greg Kroah-Hartman's presentation slides, shared via Phoronix, charted the climb from roughly 500 fixed vulnerabilities per release during the 6.x series to projections beyond 2,000 for Linux 7.3. AI-assisted static analysis has already been credited in official CVE records this year, with Intel Product Security confirming findings first flagged by automated tools.
Maintainers are responding by pruning legacy code that now attracts automated scrutiny. Andrew Lunn proposed deleting nearly 28,000 lines of networking code for obsolete ISA and PCMCIA-era hardware, while the FreeVxFS filesystem driver was retired entirely. Kroah-Hartman has used local AI fuzzing tools successfully himself, but he has barred unverified LLM-generated patches from the staging subsystem, drawing a line between assisted discovery and unvetted submissions.
This trend could reshape how open-source security is perceived and managed. If automated tools flood maintainers with marginal findings, genuine critical vulnerabilities may receive slower attention, potentially affecting enterprises and governments that rely on Linux infrastructure. The workload strain may also accelerate the removal of older hardware support, which could impact niche users running legacy systems. Ultimately, the community's ability to filter AI output responsibly may determine whether these tools become a net benefit or a persistent drain on volunteer and corporate maintainer resources.