Linux Kernel CVEs Nearing 2,000 as AI Tools Overwhelm Maintainers

The Linux kernel is approaching a record-breaking 2,000 fixed vulnerabilities per release, a sharp increase from the approximately 500 CVEs seen during the Linux 6.x era. This surge matters to developers and system administrators because it signals a fundamental shift in how the codebase is audited and maintained. The rapid rise in reported security issues reflects the growing use of artificial intelligence tools to scan the source tree.

AI scanning drives record vulnerability counts

This trend centers on the Linux kernel, an open-source operating system core that has grown to over 40 million lines of code over 35 years. Maintainers are now using AI-driven static analysis to identify bugs that human reviewers might miss. The increased volume of findings is changing the daily workflow for the people who manage these updates.

Network subsystem maintainer Jakub Kicinski estimated that between one-third and one-half of the 648 net-next patches in the Linux 7.3 cycle appeared to be driven by AI findings. These patches often include low-priority fixes, clean-ups, or clarifications rather than critical security holes. Kicinski wrote that the team is completely overwhelmed by the sheer volume of these automated reports.

The influx of AI-generated reports is also leading to the removal of legacy drivers such as ISA, PCMCIA, SGI, IBM, and FreeVxFS due to the maintenance burden. Maintainers are adopting AI tools to filter patches and are restricting LLM-generated patches in the staging subsystem to manage quality. If the current trajectory continues, Linux 7.3 could push the CVE count beyond 2,000, setting a new benchmark for automated security auditing.