Linux kernel nears 2,000 CVEs per release as AI-assisted bug hunting overwhelms maintainers

The Linux kernel is approaching a record high of 2,000 CVEs fixed per release, up from roughly 500 during the Linux 6.x era. Stable maintainer Greg Kroah-Hartman disclosed at Kernel Recipes 2026 that Linux 7.0 surpassed 1,000 CVEs, Linux 7.2 exceeded 1,500, and Linux 7.3 could push beyond 2,000 if the current trend holds.

The spike is not due to worsening security. It is largely a side effect of AI-assisted static analysis and vulnerability detection tools now routinely scanning the kernel's 40+ million lines of code. These tools surface genuine defects, but they also generate a large volume of low-priority findings, questionable patches, and outright hallucinations. Network maintainer Jakub Kicinski estimated that one-third to one-half of the 648 patches in the Linux 7.3 networking pull request were low-priority fixes or clean-ups driven by AI. "We are completely overwhelmed," Kicinski wrote.

How maintainers are responding: restrictions, legacy removal, and fighting AI with AI

Kernel maintainers are adjusting. Kroah-Hartman recently barred LLM-generated patches from the staging subsystem except for legitimate security fixes. Updated guidance now warns that submitting AI-generated reports without human verification wastes maintainer time. At the same time, the project has secured access to multiple frontier models to help review patches and filter hallucinated results, and is considering pushing routine administrative work onto LLMs in future cycles.

The noise has also accelerated the retirement of old code. Linux 7.3 removes SGI and IBM driver code, and the FreeVxFS filesystem driver was dropped after its maintainer noted that decades-old compatibility code now mainly served as input for automated bug checkers. Earlier this year, developer Andrew Lunn proposed removing nearly 28,000 lines of legacy networking code covering ISA and PCMCIA-era hardware, because AI tools were finding defects in code that almost nobody runs, forcing maintainers to investigate.

What this means for builders

For teams shipping AI-powered code analysis tools, the Linux kernel's experience is a case study in scaling vulnerability detection on a 40 million-line codebase. The lesson is blunt: raw detection volume is not the same as impact. Tools that flood maintainers with low-priority reports create work rather than reducing it. A build system that integrates an AI vulnerability scanner should include automated triage, confidence filtering, and human-in-the-loop validation to separate genuine flaws from noise.

For anyone relying on the Linux kernel for production infrastructure, the spike in CVEs per release does not indicate a less secure kernel. It reflects a new normal where more issues are found and fixed faster, but at the cost of increased maintainer overhead. The team’s decision to prune legacy drivers may reduce the attack surface for code that matters, but it also ends compatibility with decades-old hardware that some users still depend on.

Linus Torvalds has released Linux 7.3-rc1 for testing, and the kernel community will continue discussing AI’s role at Kernel Recipes in Paris this September. The direction is clear: the kernel is not rejecting AI, but it is forcing the tooling to account for its own noise.