Debian won’t ban AI code from its Linux distribution

The Linux kernel is on track to surpass a record 2,000 vulnerabilities per release, a significant jump from around 500 fixed in earlier Linux 6.x versions. The surge in vulnerability fixes is attributed to the use of artificial intelligence tools scouring the sprawling Linux kernel codebase of over 40 million lines, a task that would have been practically impossible for human developers.

These AI-driven tools can examine every nook and cranny, even in seldom-documented areas, leading to the discovery of genuine vulnerabilities and subsequently confirmed by Intel Product Security. However, many of these findings, often low-priority or dubious, have overwhelmed kernel maintainers who now face the daunting task of separating useful fixes from AI-generated noise.

Linux maintainer Jakub Kicinski lamented that between one-third to one-half of the 648 patches in the Linux 7.3 networking pull request appeared to be low-priority fixes, clean-ups, or clarifications driven by AI. This has led to discussions among maintainers about the necessity of keeping decades-old drivers alive, as AI and fuzzing tools have unearthed defects in them, necessitating time-consuming investigations and fixes.

The Linux kernel community is now grappling with how to handle the influx of AI-generated issues without being bogged down by false positives. While some maintainers have barred AI-generated patches from the kernel's staging subsystem, except for critical security fixes, the community has also turned to AI to assist in reviewing patches and filtering out AI hallucinations.

Linus Torvalds, the Linux creator, is expected to address the AI-driven vulnerability landscape further at Kernel Recipes, an upcoming event in Paris.