The Linux Kernel Is Approaching 2,000 CVEs Per Release (phoronix.com) 3
Phoronix reports on Greg Kroah-Hartman's recent slide from his upcoming talk in Paris at Kernel Recipes 2026 (September 21 to 23):
With the proliferation of AI/LLM models analyzing the Linux kernel's vast codebase, there has been a surge in the number of CVEs per kernel release. After typically being around 500 CVEs fixed per release, we are now approaching 2,000 CVEs fixed per release and perhaps will break that threshold for Linux 7.3... Fortunately, most often they end up being lower priority vulnerabilities and often within old/obscure driver code, so the impact is often minimal.
It seems that AIs have great eyeballs (Score:2)
To work Linus' Law [wikipedia.org] needs many eyeballs, unfortunately these are not always around. It seems that AI is helping - which is good. I assume/hope that the current deluge will abate once the current/historic CVEs get fixed and that the only new ones are for bugs in new code.
This is the correct use for AI (Score:2)
Worth keeping in mind (Score:3)
Many CVE's are somewhat junk of the form if you already have 3 ways to legitimately become root, you can use this 4th way too. OR (samn close to) OMG!!! Denial of Service attack, you can turn off the power and nobody can access the server!!! RED ALERT!!!
Others are real and need to be addressed, but the junk does more harm than good by distracting from real issues.