Linux Kernel Overwhelmed by AI-Driven Vulnerability Reports

The Linux kernel is experiencing an unprecedented surge in reported vulnerabilities, approaching 2,000 CVEs (Common Vulnerabilities and Exposures) per release—nearly quadruple the ~500 seen during the Linux 6.x era. This dramatic increase isn't due to declining security, but rather AI and machine learning tools scanning Linux's massive 40+ million lines of code accumulated over 35 years. Key Points: CVE explosion: Linux 7.0 saw over 1,000 CVEs, Linux 7.2 exceeded 1,500, and Linux 7.3 may surpass 2,000 AI-driven detection: Automated tools are discovering vulnerabilities in obscure code sections rarely examined by humans Quality concerns: Many findings are low-priority bugs, questionable patches, or AI "hallucinations" rather than critical security issues Maintenance burden: Network maintainer Jakub Kicinski reports one-third to one-half of patches are AI-driven low-priority fixes, stating teams are "completely overwhelmed" Legacy code removal: Maintainers are now removing decades-old drivers (nearly 28,000 lines of legacy networking code, old SGI/IBM drivers, FreeVxFS filesystem) because the cost of investigating AI-found bugs in unused hardware drivers outweighs their value The situation highlights an unintended consequence of AI bug-hunting: while some genuine vulnerabilities are found, the flood of reports is forcing maintainers to reconsider whether maintaining ancient, rarely-used code is still worthwhile.