Background: From 500 to 2,000, CVEs more than tripled

Greg Kroah-Hartman put a single set of numbers on a slide he is preparing for Kernel Recipes 2026 in Paris on September 21–23. Through the Linux 6.x era, each stable release shipped with roughly 500 CVE fixes; Linux 7.0 pushed that past 1,000, Linux 7.2 already exceeds 1,500, and on the current curve, Linux 7.3 — due late October — will cross 2,000. The kernel source has grown to over 40 million lines over 35 years, but almost the entire spike is coming from external LLM and AI static-analysis tooling auto-scanning the tree, not from the kernel itself becoming more fragile.

Sources and method

The numbers come from a Tom's Hardware piece on September 1, citing Kroah-Hartman's slides plus the statistics Jakub Kicinski wrote into the Linux 7.3 networking pull request. Solidot's Chinese summary on September 3 lines up: same figures, same maintainer quotes.

Maintainers' situation: one third to one half is noise

Kicinski's verdict in the 7.3 networking pull request is unusually blunt: out of 648 net-next patches in this cycle, he estimates one third to one half are AI-driven low-priority patches, cleanups, or “rhetorical clarifications.” He writes, flat out, “We are completely overwhelmed.” Most of those patches originate from obscure ISA/PCMCIA-era drivers, low-severity findings from AI static analysis, and outright false positives from model hallucinations. Maintainers are contractually obligated to triage them — that obligation is built into 35 years of upstream workflow.

Worse, this year's Linux CVE entries already explicitly credit AI-assisted static analysis under “discoverer,” with Intel Product Security confirming some of them after manual follow-up. The problem is that almost everything AI submits is low-severity or edge-case, with very little actual exploitability, but every single item still costs a human reviewer.

Old code is being cut as “abandonware”

Cheap AI sweeps are making old drivers suddenly “visible,” and maintainers are responding by deleting code rather than fixing it. In April, Andrew Lunn proposed removing about 28,000 lines of legacy ISA/PCMCIA networking code; Linux 7.3 actually deletes the old SGI and IBM drivers, and the FreeVxFS filesystem was also dropped after its maintainer said the decades-old compatibility layer had become “mainly fodder for AI scanners.” The cost maintainers are responding to is not a code defect — it is the maintenance load that AI has just re-lit, and that line is moving.

The kernel community's response: not anti-AI, anti “unverified AI”

Kroah-Hartman has himself used local AI-assisted tools to catch real bugs. What he pushes back on is unverified AI output dumped onto the mailing list. He has barred LLM-generated patches from the staging subsystem except for legitimate security fixes, and the latest kernel documentation explicitly warns that unverified AI reports waste maintainer time.

At the same time, the kernel team is choosing to “fight AI with AI”: they have secured access to multiple frontier models to help review patches and filter hallucinations, and are considering moving more routine administrative work onto LLMs in future cycles.

Industry takeaway: maintenance cost in the LLM era

This is a useful warning for other large open-source projects. LLMs have dramatically cut the marginal cost of “finding bugs” and transferred that cost to human review. Any project without a matching acceleration loop upstream is eventually going to hit the same wall Kicinski describes. For LLM providers, that means building evidence chains and credibility scoring into output formats, not just emitting a plausible paragraph.

For anyone tracking Linux 7.3: Kroah-Hartman will bring fuller data to Paris in late September; in the meantime, Linux 7.3-rc1 shipped August 30 with the merge window closed, and the stable release is expected in late October. The 2,000 figure, most likely, will be revised upward.