Forgot your password?
Close
typodupeerror
AI Bug Linux

The Linux Kernel Is Approaching 2,000 CVEs Per Release (phoronix.com) 35

Posted by EditorDavid from the battling-bugs dept.
Phoronix reports on Greg Kroah-Hartman's recent slide from his upcoming talk in Paris at Kernel Recipes 2026 (September 21 to 23): With the proliferation of AI/LLM models analyzing the Linux kernel's vast codebase, there has been a surge in the number of CVEs per kernel release. After typically being around 500 CVEs fixed per release, we are now approaching 2,000 CVEs fixed per release and perhaps will break that threshold for Linux 7.3... Fortunately, most often they end up being lower priority vulnerabilities and often within old/obscure driver code, so the impact is often minimal.

The Linux Kernel Is Approaching 2,000 CVEs Per Release More | Reply

The Linux Kernel Is Approaching 2,000 CVEs Per Release

Comments Filter:

  • To work Linus' Law [wikipedia.org] needs many eyeballs, unfortunately these are not always around. It seems that AI is helping - which is good. I assume/hope that the current deluge will abate once the current/historic CVEs get fixed and that the only new ones are for bugs in new code.

    • It sounds like it finds the most bugs in code with the least human attention given to it (old drivers, etc.) In other words, it gets the low-hanging fruit.

      So it's better than nothing, but not as good as human review. It could have a place in the security ecosystem. Will it come at the expense of human reviewers, though? Because then it's a net negative.

      • Re: (Score:2)

        by gweihir ( 88907 )

        Exactly. It also needs to be done as the attackers will do it as well. But in a while this effect will die down and we are back to humans doing the vast majority of problem finding.

      • Re: (Score:2)

        by allo ( 1728082 )

        Nobody stops the humans. They now have more time for important code while the AI collects all the tedious bugs that just "need to be fixed" and cost time with little benefit (but should definitely be fixed).

    • Re: (Score:2)

      by gweihir ( 88907 )

      Not really. LLMs are actually pretty crap at this. But they have a somewhat different perspective than humans and are not prone to boredom. So they find bugs now that humans did not find, but that is a pretty temporary effect.

  • This is the correct use for AI (Score:3)

    by Valgrus Thunderaxe ( 8769977 ) on Saturday August 29, 2026 @02:27PM (#66313060)
    vs. weaponizing it to spy on people.

    • Re: (Score:2)

      by allo ( 1728082 )

      Do you really think anyone decides between these two? "I have an AI ... let me think, should I fix Linux or use it to better target ads ... hmmm?"
      These are completely different people who consider these uses.

  • Worth keeping in mind (Score:5, Informative)

    by sjames ( 1099 ) on Saturday August 29, 2026 @02:39PM (#66313072) Homepage Journal

    Many CVE's are somewhat junk of the form if you already have 3 ways to legitimately become root, you can use this 4th way too. OR (samn close to) OMG!!! Denial of Service attack, you can turn off the power and nobody can access the server!!! RED ALERT!!!

    Others are real and need to be addressed, but the junk does more harm than good by distracting from real issues.

    • The thing is, Linux is a general purpose kernel rather than something only ever used to run servers with, so the kernel folks can't predict everyone's security model and so have to report anything which allows more to be done with any set of privileges than should be possible, whatever it is. What's really needed here is a secondary classification stage, something like a project which makes a set of assumptions about the security model which are true in most servers and you can check are true for your serve

      • Re: (Score:2)

        by sjames ( 1099 )

        Way to over-interpret the example! It doesn't matter if it's client, server, embedded, isolated standalone. A method where root can "gain" root access is not a security issue.

    • Re: (Score:2)

      by tlhIngan ( 30335 )

      Actually the main issues are because the Linux kernel ships with a lot of drivers and many of which have lots of issues.

      It's why the kernel has been expunging a LOT of code as well - older architectures as well as drivers that haven't seen much development are getting expunged to reduce the number of lines of code that AI will have issues with. It's why there's basically only one staging driver left - and it was kept around as it's still being used. But the rest of staging was expunged.

      I suspect the Linux k

      • Re: (Score:2)

        by sjames ( 1099 )

        MS has been doing that for a good while, which is why in the few cases I have installed Windows on something, I have had to boot a Linux rescue disk to download a network driver Windows was missing.

    • Re: (Score:2)

      by allo ( 1728082 )

      So be happy that the AI does the "junk" and you can do the real work?

  • To me it sounds problematic if each release has even more CVEs found by AI fixed, as you should think that after a few releases that number should decline instead of increase as most CVE's should be fixed by then and only a very few new CVE's should be found (like ways never thought off, so nobody looked for those).

  • Given that all new patches are probably checked soon after they are pushed, there will be a day when most older bugs are found. Then the number will go down again, and this will be a good sign.

  • Whew thank God Linux is a monolithic kernel with a minimal attack surface and no drivers up the wazoo to worry about.

    • Re: (Score:1)

      by davidwr ( 791652 )

      Whew thank God Linux is a monolithic kernel with a minimal attack surface and no drivers up the wazoo to worry about.

      There are ways to do just that. Minimal drivers, all compiled in. No loadable modules. Secure/trusted boot environment. Minimal access to I/O with strong input sanitization and very likely a read-only filesystem so a reboot is a true fresh start. This won't be your general-purpose computer though.

  • So open source like Linux will gradually become more secure, whereas closed source will never get fixed.

    • Re: (Score:2)

      by twms2h ( 473383 )

      So open source like Linux will gradually become more secure, whereas closed source will never get fixed.

      That's what we have been told for years. But if that's true, how come LLMs are finding so many bugs now?

  • The LLMs currently find all the boring bugs nobody was interested in finding. Once these are gone, we will be back to normal.

Slashdot Top Deals

If what they've been doing hasn't solved the problem, tell them to do something else. -- Gerald Weinberg, "The Secrets of Consulting"

Close