Linux Maintainer Greg Kroah-Hartman Says AI Tools Now Useful, Finding Real Bugs

Linux kernel maintainer Greg Kroah-Hartman tells The Register that AI-driven code review has "really jumped" for Linux. "There must have been some inflection point somewhere with the tools..." "Something happened a month ago, and the world switched. Now we have real reports." It's not just Linux, he continued. "All open source projects have real reports that are made with AI, but they're good, and they're real." Security teams across major open source projects talk informally and frequently, he noted, and everyone is seeing the same shift. "All open source security teams are hitting this right now...."

For now, AI is showing up more as a reviewer and assistant than as a full author of Linux kernel code, but that line is starting to blur. Kroah-Hartman has already done his own experiments with AI-generated patches. "I did a really stupid prompt," he recounted. "I said, 'Give me this,' and it spit out 60: 'Here's 60 problems I found, and here's the fixes for them.' About one-third were wrong, but they still pointed out a relatively real problem, and two-thirds of the patches were right." Mind you, those working patches still needed human cleanup, better changelogs, and integration work, but they were far from useless. "The tools are good," he said. "We can't ignore this stuff. It's coming up, and it's getting better...." [H]e said that for "simple little error conditions, properly detecting error conditions," AI could already generate dozens of usable patches today.

The sudden increase in AI-generated reports and AI-assisted work has also spurred a parallel push to build AI into the kernel's own review infrastructure. A key piece of that is Sashiko, a tool originally developed at Google and now donated to the Linux Foundation.
Kroah-Hartman said some patches are being generated with AI now. "You have a little co-develop tag for that now. We're seeing some things for some new features, but we're seeing AI mostly being used in the review."

For me, it is last few months...

[dragisha]

since AI agents became usable and started to bring results.
Of course, you must have skills usually not associated with the manager caste - ask precise questions, be realistic in expectations, and be ready to jump in and fix in ten minutes instead of spending time on 5 prompts. Among others.
So it is not a question about AI being usable or not; it is a question about it being useful enough to cover its expenses and ensure ROI.
An improbable thing to happen.

Re:

[HiThere]

Compare this to what you would have said last year.

Re:

[dragisha]

Compare this to what you would have said last year.

I remember it well enough.
Read under "its expenses". All this is extremely costly and needs skills I started to enumerate. It is also cheap today, but it will not remain so.
If not for the Chinese factor, prices would have skyrocketed already. Real competition there is what keeps prices in check. And this, while being good for us, is not so good for (esp. US) AI industry. No real perspective on ROI, and we have yet to see what happens when the bubble bursts.
Just the other day, I compared AI agent use to the

Re: For me, it is last few months...

[dknj]

The ROI is at the nation-state level. The ones who benefit are the rich and powerful in control right now. The reason it is being gatekept is to give the elite the power now that will be harder to wrestle from later.

Re: For me, it is last few months...

[commodore73]

I would add that there are levels such as concentrated wealth above and outside nation states and benefiting from swarm theory on aligned interests without explicit cooperation, but what would that have to do with whether "AI" is useful at identifying code defects...

Re:

[Kisai]

The answer to that is "absolutely not"

If you can't code worth a damn, then of course the AI is going to find a lot of "bugs" and many of those bugs aren't even bugs, they generate warnings in the compiler otherwise the program would not compile in the first place. The first thing you do when you want to eliminate bugs is "treat all warnings as errors"

You don't need AI for that.

I'm sure AI is useful for finding errors that don't show up as warnings first, but I can tell you first and second hand that your av

Re:

[keltor]

Dunning Kruger Effect but from someone with a 6 digit ID ...

Everything about about this is: https://www.youtube.com/watch?v=LQCU36pkH7c

Re: For me, it is last few months...

[xgerrit]

I'm not here to hype AI. After decades wielding terminals and IDEs I'm being forced to use it. I still want to write code that I don't because it will hurt my AI use metrics that count toward my performance. This is what it's like at a major tech company in 2026. But the picture has changed. AI can search through our codebase and find real bugs. Subtle ones.

Posts like this are unhelpful because they paint a picture that there are these limitations that really aren't there anymore. If you're not getting the

Re:

[swillden]

If you can't code worth a damn, then of course the AI is going to find a lot of "bugs"...

If you're asserting that Greg Kroah-Hartman can't code worth a damn, you might want to find out who he is and think again.

Re:

[kertaamo]

"If you can't code worth a damn, then of course the AI is going to find a lot of "bugs" ..."

But this is Greg Kroah-Hartman we are talking about here, and many other kernel devs. If you are saying they can't code worth a damn then we cannot take you seriously.

Also note that may bugs, either logical errors or silly memory use mistakes (use after free, out of bounds array access, etc, etc) or UB, are not detected by the compiler as errors or warnings.

So, if AI can find those bugs what is not to like? Of course

Re:

[sg_oneill]

In fairness, this is the Kernel we are talking about, and those dudes actually do know what they are doing.

Kernel code is fucking hard. The last kernel coding I ever did was on Minix in the early 1990s for Operating Systems class at University. That was a total brain bender. But heres the thing, Minix was an intentionally simpler kernel designed for teaching and included an extremely comprehensive textbook, that just doesn't exist (I think) for Linux.

The Linux Kernel may well be the most complicated code by

Re:

[gweihir]

it is a question about it being useful enough to cover its expenses and ensure ROI. An improbable thing to happen.

With them currently needing bout 15x as much revenue as they have to keep the lights on? Very improbable indeed.

Re:

[keltor]

AI is 100% a usable valid tool, but I still have to basically check everything.

One thing that would be interesting

[rsilvergun]

If AI ever gets to the point where it can outperform human beings at finding defects then there's going to be a major issue with world powers.

That's because right now if you really want to hack somebody's data you can do it. There is a company out of Israel that will sell you software if you have enough money had enough connections and that software can break into just about any phone in existence. If they can break into the phones they can get past most encryption mechanisms.

So the question is what happens if intelligence agencies and law enforcement can no longer get data when they really want it.

I'm not so naive to think that is going to be a glorious time of freedom.

Facebook for example is facing an existential crisis from AI slop. There is so much slop and it is so hard to tell from the real content they are having a hard time getting data they can sell. Advertising rates are also at risk although it's less of an issue because as it stands advertising on Facebook is pretty useless and largely done out of habit. But the risk of slop overwhelming their data collection is a much bigger deal.

I bring it up because Facebook didn't just roll over and die. They are going around the world buying off politicians and getting laws passed requiring age verification that will in turn let them identify real users from bots so that they can continue to collect your data and sell it to their advertisers and governments and whatnot.

My point being that when a large powerful group faces a problem they solve it. And when somebody with that much money in power has a problem and they solve it it's usually to your detriment and mine.

What I would expect is that we are going to lose more freedoms. And any attempt to save those freedoms will fail because at the end of the day we would have to vote for politicians that would protect those freedoms and I think the 2024 elections proved that it's pretty easy to get people to do the opposite if you dangle cheap eggs in front of them...

Re: One thing that would be interesting

[Z00L00K]

I see that AI can find bugs that are tedious to find and only exists in corner cases that normal humans usually don't test. For every successful positive test case there can be a large number of negative cases with subvariants. That's where AI might be helpful - create all those test runs.
But to write code that's maintainable, with high performance and stable - that's a different thing.

Test code that doesn't work - just generate a new batch, it won't damage the product you deliver but it might have some fla

Code review is not what AI is being sold as

[dfghjk]

There's nothing wrong with using AI tools to review code and identify issues, real humans will review those issues and solutions after all. It's a far cry from what the AI industry claims AI tools will be useful for, specifically writing all the code in the first place.

Writing good code requires creativity, hard work and accountability; reviewing code is all over the map, it doesn't require creativity and does not come with accountability. Sounds like something AI might be suited for.

Re:Code review is not what AI is being sold as

[LainTouko]

In general, the principle problem with LLMs is that they're completely unreliable, due to the basic design. But in cases where they''re just saying "look at this, maybe this is a problem", reliability is not required because if it makes no sense, someone can just say "no". The problem comes when people begin to trust them, despite them being completely untrustworthy. Applications where trust is not required are fine.

Re:

[bwoodring]

The principle problem with humans is that they're completely unreliable, due to basic design.

Re:

[TeknoHog]

The principle problem with humans is that they're completely unreliable, due to basic design.

They seem particularly unreliable when asked to tell the difference between a headmaster and a fundamental rule.

Re:

[bloodhawk]

AI absolutely is being sold for code review. It is also assisting with code writing. The vast majority of good code requires precisely ZERO creativity; it requires accuracy and following strict business rules.

This is a good approach

[MpVpRb]

Instead of using AI to "increase productivity" by quickly generating bloated, inefficient, bug-ridden, insecure slop, the better use of the tools is to find bugs, security weaknesses and unhandled edge conditions. AI research should focus on creating better code, bug-free, efficient and secure with all edge cases handled

He was one of the best of us

[Iamthecheese]

Rest in peace MJ Rathbun

In No Way Worth the Cost

[BrendaEM]

From the getgo, most of he sites you visit, you will be checked for AI--because AI has scraped everything from the internet, copyrights or not. Add to that problem. we are already seeing raising unemployment, oil-eating/planet-warming data centers, billionaires becoming even richer so they can meddle with you government--and for what?

Re:

[real_nickname]

They said it was to cure cancer but brain rot and fake young women is what we got.

Re:

[backslashdot]

It will cure cancer. In combination with robotics it will make personalized cancer treatments based each person's tumor genome. Basically once you have a few biopsies of a person's cancer, you can determine what proteins, DNA, and RNA are aberrant and design a treatment against that.

Re:

[real_nickname]

That's altman own words: "grind for a decade trying to help make superintelligence to cure cancer". His company main focus is not to cure cancer, LLM and video/image generator which is where the money go won't cure anything. AI used in medical research cost nothing in training compared to these things and don't attract VC money. They just want to replace human workers to sell their product to make more money which will ironically lead to more deaths from cancer because jobless people won't be able to affor

Yep

[cascadingstylesheet]

A tool. A very useful tool, if you know what to use it for and how to use it.

Unfort. e'ryone picked an opinion/side two yrs ago

[Hadlock]

Unfortunately everyone picked an opinion two years ago, when AI was genuinely garbage beyond some basic bash scripts or a top 1000 bug/question on stack exchange (which mostly overlap). AI started getting really good in Dec '24, particularly spring '25 and by August 2025 even the $20/mo tier of chatgpt was starting to get legit as OpenAI started to try catching up with (now market leader) Anthropic and their blessed claude code. The 4.5/4.6 models released this year are nothing short of incredible, and the

Re:

[lucifuge31337]

"Everyone" did not, but people who tend towrads black and white thinking (like someone who would use "everyone" in this context) have.

The question is not what bugs they find

[gweihir]

The question is what bugs they miss. Because that determines whether you still need to do a full review and that review does not actually get mich faster when there are fewer bugs.

LLMs can't explain themselves

[ndykman]

One issue with the overall architecture (which is just statistical prediction) is that it can't really provide useful insights on why it did what it did. Which was requirement of expert systems back in the day.

Honestly, it seem like building better static analysis tools for finding these kind of problems is a better way to go overall. The tools could be more relaxed on reporting potential issues and allow more false positive versus focusing on reporting things that are certainly bugs, but still be based on

Re:

[swillden]

One issue with the overall architecture (which is just statistical prediction) is that it can't really provide useful insights on why it did what it did.

I think you're describing the models from a year ago. Most of the improvements in capability since then (and the improvements have been really large) are directly due to changes that have the AI model talk to itself to better reason out its response before providing it, and one of the results of that is that most of the time they absolutely can explain why they did what they did. There are exceptions, but they are the exception, not the rule.

It's interesting to compare this with humans. Humans generall

Re:

[allo]

That's not completely true anymore, but in particular not that relevant if it can do a post-hoc explanation.

Why you're right: Generating something does not allow the LLM to explain it without making up a new explanation (with caveats)
Why you're wrong: Thinking models first generate a thinking trace and then answer based on this. The thinking trace is a good explanation for the answer that comes after
Why it doesn't matter: If a second run can explain the code (in a second run), it is not important what the r

Who cares about code, replace government with AI

[maird]

On the one hand I've had a fun week adapting a personally written multi-mode audio signal monitor to add seismic monitoring with some guidance on limiting requirements by Gemini, though I designed and wrote the code myself using Gemini to check a few corner cases that failed unexpectedly. But seriously, why have human representatives or leaders with personal prejusdices and prejudices that change solely from losing some "argument". Add lawyers, judges and jurors to that list. There's enough published mater

Re:

[noshellswill]

The idea for a (re)public is NOT to make it's governing better, but to ensure that the citizenry govern themselves. Screw the well governing *.AI ! Defending currency value and national borders are the assigned  Fed  governmental tasks.  Power over all else devolves to states and municipalities ... and  preferably to the individual citizen. Unless you are a fan of tyrannous statism or mobocracy.

I for one welcome our new AI overloards

[SnappingTurtle]

It's the future. Get used to it.