AI is finding thousands of bugs in Linux, and maintainers can barely keep up

AI technology has recently discovered over 1,000 critical vulnerabilities in major open-source projects like the Linux kernel, with more flagged by other AI systems this year. This surge in AI-detected bugs has led to a significant increase in the number of CVEs fixed per Linux kernel release, from approximately 500 to nearly 2,000 in recent versions.

Ahead of the 2026 Kernel Recipes event in Paris, Linux kernel maintainer Greg Kroah-Hartman presented a graph showing the sharp rise in CVEs found in the kernel over the past stable releases. The count jumped from around 500 vulnerabilities per release between versions 6.9 and 6.19 to about 1,000 per release from Linux 7.0 onwards, and surpassed 1,500 in Linux 7.2.

Most of these bugs were caught by AI code review platforms and large language models, and the number may exceed 2,000 by Linux 7.3 as AI systems become more capable. While the vast majority of documented CVEs are low-priority or affect obsolete drivers and long-deprecated features, Linux's source code runs to around 40 million lines, meaning thousands of vulnerabilities remain undiscovered.

However, the AI-driven bug reports have benefited the kernel codebase, with maintainers recently clearing out old drivers and the ISDN subsystem that harbored dozens of CVEs. Linus Torvalds warned that the kernel's private security mailing list had become "almost entirely unmanageable" with the report volume rising from around 2-3 per week two years ago to 5-10 every day in 2026.