Linus Torvalds sees signs AI-prompted patch flood has peaked

Linus Torvalds, the leader of the Linux kernel development community, believes that the worst of the patchpocalypse may be over. His weekly kernel update post, which introduced Linux 7.4 rc2, indicated two significant reasons for the release. The first reason was the omission of certain code from the previous release, rc1, due to time constraints and the complexity of the changes. The second reason was a surge in "various AI fixes" that developers needed to address.

These AI fixes have become necessary since Anthropic launched its Mythos bug-finding model in April, enabling developers to identify software flaws more efficiently than ever before. This has led to a record-breaking number of vulnerabilities being fixed, with Microsoft addressing 974 flaws in September alone, surpassing its previous records of 622 flaws in July and 206 in June. Oracle also experienced a record-breaking month, fixing 1,449 flaws.

However, Torvalds' post suggests that the worst of this AI-fueled patch deluge might be behind us. Alexei Starovoitov, co-creator and lead developer of the Extended Berkeley Packet Filter (eBPF), reported that the fixes for the bpf side of the kernel are now coming in faster than new reports are coming in. This is a significant development, as it indicates that the eBPF project might be experiencing a turning point in how quickly it can address AI-finding vulnerabilities.

While other areas of the kernel have not reached the same pace, Torvalds believes that this could be a sign that the tide is starting to turn. Although it's premature to celebrate, there is a possibility that the flood of fixes developers and users need to handle may have reached a peak.