Thought Leadership
The number of CVE security vulnerabilities fixed per Linux kernel version is approaching a new peak of around 2,000.
Linux stable maintainer Greg Kroah-Hartman presented the development in a pre-released presentation slide for his upcoming talk at the Kernel Recipes 2026 conference in Paris. According to this, the number of fixed CVEs averaged around 500 per version across the entire Linux 6.x generation. With Linux 7.0, the value exceeded the 1,000 mark for the first time, and with Linux 7.2 it already reached 1,500. As of September 1, 2026, the number is already approaching nearly 2,000; should the trend continue, the upcoming version 7.3 could cross this threshold for the first time.
The underlying kernel source code has meanwhile grown to more than 41 million lines; between versions 7.2 and 7.3 alone, around 560,000 new lines were added, a significant portion of which was due to a single AMD graphics card driver register dump containing 6.52 million lines.
According to consistent assessments by several trade media outlets, AI tools are systematically scanning even particularly obscure or rarely audited code sections that human reviewers very seldom revisit, and occasionally finding genuine, previously undiscovered bugs. However, the vast majority of newly reported vulnerabilities affect older, barely used driver code areas and are categorized as comparatively low priority, meaning the actual practical impact for most users should remain limited.
Obsolete code is also being consistently removed
Several trade media outlets view it as a positive side effect of this development that maintainers have already completely removed significantly more obsolete, barely maintained code from the kernel during the current year, such as old driver code for SGI and IBM hardware. The driver for the FreeVxFS file system, for instance, was completely scrapped after the responsible maintainer himself stated that the decades-old compatibility code now largely served only as practice material for automated bug-hunting tools. Such a cleanup simultaneously reduces the remaining attack surface as well as the number of future reports triggered by the same obsolete code.
Security expert Sasson contextualized the fundamental issue: The same thorough analysis that helps maintainers track down these bugs works just as well from the adversarial side. For only a few cents per million processed tokens and without anyone monitoring, attackers could scan the same code with the same tools, which in practice represents the actual core of the growing challenge.
Linux community responds with adapted workflows rather than rejection
Unlike in some other software projects, the increased use of AI in Linux kernel development is not meeting with fundamental rejection, according to consistent reports. Linux creator Linus Torvalds himself had recently publicly spoken out clearly in favor of the pragmatic use of AI tools in the development process and, according to his own statements, regularly uses the AI model Gemini together with Andrew Morton, the maintainer responsible for memory management code, for debugging and summarizing submitted patches. The kernel community itself is responding to the surging flood of reports less with rejection of the underlying tools, but rather with adapted, more heavily automated workflows for reviewing and prioritizing incoming reports.
The development is explicitly not limited to Linux alone: According to reports, Microsoft is also increasingly utilizing AI to discover Windows vulnerabilities, while the FreeBSD project has now officially integrated AI-assisted security research into its own development processes.
(Editorial Team)
