If you picture the Linux kernel as a giant software factory, the most unusual thing about the 7.2 release candidate cycle is this: weekly patch volume more than doubled, yet the merge window still closed on schedule. Linus Torvalds did not dodge the change in his August 9 announcement of 7.2-rc7 — the title literally read "the new normal," and the body acknowledged that many of the patches were a product of "review by various AI tools." This was not marketing. That single rc7 week merged 412 file changes from over 230 signed-off contributors; the historical baseline is 150 to 200 files per rc and roughly 15% of commits carrying a "Fixes:" tag, while this cycle hit about 29%. AI-driven automated review has pushed kernel "late-stage patching" density onto a new floor.
The tool at the center of this shift is an agentic reviewer called Sashiko, open-sourced by Google's Roman Gushchin in March 2026, hosted at github.com/sashiko-dev/sashiko. It performs an automated second pass on every patch hitting LKML and several subsystem mailing lists, with Gemini 3.1 Pro doing the actual analysis. The name "Sashiko" comes from a Japanese embroidery technique — decorative reinforcement stitching — and the metaphor fits: it stitches an extra structural check onto every patch. Replayed against 1,000 recent upstream bugs tagged "Fixes:", Sashiko recovered roughly 53% of the defects. Those same defects had all been missed by human reviewers.
What un-nerves maintainers is not just the volume but the bug classes AI is uncovering. 7.2-rc7 included a fix for an 8-year-old memory-management race — a use-after-free quietly lurking in production kernels. Earlier, in April, Claude Code surfaced a 23-year-old heap overflow in the NFSv4.0 LOCK replay cache: a 112-byte buffer was being fed a 1,056-byte owner ID field. Remotely exploitable. Sitting there for two decades. This is not an isolated case. Phoronix's 7.2-rc7 analysis reported that the kernel security list now receives 5 to 10 valid AI-generated vulnerability reports per day, and maintainers confirm that overall report quality has improved substantially since mid-2025.
The kernel community did not simply absorb this change — they codified it. In April 2026, after months of debate, the community wrote AI tool usage into a document called coding-assistants.rst. The core requirement: if AI helped write or review a patch, declare it with an Assisted-by tag, such as Assisted-by: Claude:claude-opus-4-6 coccinelle sparse. AI systems are not allowed to add a Signed-off-by — that line carries legal weight in the kernel development process, standing in for the developer's certification of code quality and licensing. The human who submits a patch takes full responsibility; AI does not.
The side effect of this automated scrutiny landed unexpectedly on the back legacy code. AI does not discriminate: it reads 1999 drivers and 2003-era hardware support code with the same attention it gives active subsystems. In April 2026, Torvalds merged a cleanup that removed 138,000 lines of ISDN and PCMCIA-era code. In August, Greg Kroah-Hartman deleted the Moxa Intellio serial driver — 2,148 lines written in 1999, hardware discontinued in 2017 — with a bluntly pragmatic reason: LLMs "poking at the code and finding interesting things would waste maintainers' time." In the AI era, legacy code no longer has a "nobody is looking, so nobody changes it" safe harbor.
What this "new normal" means for developers
Torvalds made his position plain in July: "Linux is not one of those anti-AI projects." Disagree? Fork it yourself. That is not enthusiasm — it is acceptance. AI tools find real bugs at a rate human review cannot match. The cost does not disappear; it just shifts from "few deep reviews" to "many shallow triages." For anyone contributing to the kernel, the calculus is simple: tag your AI assistance with Assisted-by, expect AI-flagged issues in code you have not touched in years, and if you maintain a driver for hardware discontinued in 2003, start thinking about whether you would rather fix what Sashiko finds next, or simply retire the driver.
The implications reach beyond the kernel. Any large, long-evolving open-source project — databases, browsers, container runtimes, distribution packaging layers — will run into the same script in the coming years: automated tools sweep through dusty corners first, then humans decide which corners are worth repairing and which should be torn down. AI will not make the kernel perfect. But it has already made "nobody is looking" no longer true.
Sources: byteiota coverage, Undercode Testing detailed analysis, Solidot on Linux 7.2 release.