Linux kernel CVEs surge toward 2,000 per release as AI bug hunters intensify
AI and LLM models analyzing the kernel codebase have quadrupled vulnerability reports, leaving maintainers overwhelmed.
What to know
- CVE counts per Linux kernel release have jumped from ~500 to nearly 2,000 since Linux 7.0, driven by AI/LLM models analyzing 40 million lines of code.
- Most newly discovered vulnerabilities are low-priority issues in obsolete or obscure driver code with minimal real-world impact.
- The surge in reporting volume has overwhelmed kernel maintainers despite the mostly minor severity of findings.
“After typically being around 500 CVEs fixed per release, we are now approaching 2,000 CVEs fixed per release and perhaps will break that threshold for Linux 7.3.”
Phoronix · Phoronix
Greg Kroah-Hartman Linux kernel maintainer
The record 5 articles and posts · last 30 days
What people are saying 8 voices from 2 sites · verbatim
- Sep 2
-
NSA is the one doing this sort of attack, only goverments have resources for this kind of shit. China, russia, usa always have backup 0 days or already backdoored system components in transit
-
If a stupid bot then tries to exhaustively search all the ways you are fucked once you have root You have missunderstood. You can chain minor vulnerabilities to get root access. You go from you need very special privileges and a user account, up to any guy any where with these smaller ones. You will see this sometimes when packages update that…
-
Yes, pretty much. And also..... (I really don't want to be that person but you made calibrate my internal clock ) this happened over two years ago. What?
-
I still remember the advice on how to totally secure your computer. Unplug it, chain it up, encase it in concrete and throw it into the ocean.
-
I'll take thousands of unintentional vulnerabilities over blatant and intentional spying from micro-slop all day every day.
- Sep 1
-
That's probably part of why they're so overwhelmed. They have to classify, assess the amount of work and prioritize thousands of CVE notices. And until it has been clarified, everything is urgent. This all happens before even any code has been written.
-
# LinuxKernel nears record 2,000 # vulnerabilities per release as AI bug hunters scour 40 million lines of code — maintainers say they are 'completely overwhelmed' by # CVE finds # Linux stable maintainer Greg Kroah-Hartman revealed the trend in a slide teasing an upcoming presentation at Kernel Recipes 2026, showing CVE counts jumping above 1,000…
- Aug 29
-
The # LinuxKernel Is Approaching 2,000 # CVE Per Release With the proliferation of # AI /#LLM models analyzing the # Linux kernel's vast codebase, there has been a surge in the number of CVEs per kernel release. After typically being around 500 CVEs fixed per release, we are now approaching 2,000 CVEs fixed per release and perhaps will break that…