AI is finding thousands of bugs in Linux, and maintainers can barely keep up

Facepalm: GLM-5.3, the large language model from Chinese AI company Z.ai, recently helped uncover more than 1,000 critical vulnerabilities across major open-source projects, including the Linux kernel, adding to the thousands more flagged by other AI systems this year. That torrent of AI-detected bugs is now pushing the number of CVEs fixed per Linux kernel release to nearly 2,000, up from roughly 500 per release for several years running.

Ahead of this month's Kernel Recipes 2026 event in Paris, Linux kernel maintainer Greg Kroah-Hartman shared a graph charting the steep rise in CVEs found in the kernel over the past several stable releases. The slide shows that between versions 6.9 and 6.19, security researchers spotted around 500 vulnerabilities per release, on average.

From Linux 7.0 onward, that number jumped to around 1,000 CVEs per release, and Linux 7.2 pushed it past 1,500. Most of the bugs in recent releases were caught by AI code review platforms and large language models, and the count could climb above 2,000 with Linux 7.3 as frontier AI systems keep getting more capable.

At first glance, 2,000 CVEs in the Linux kernel sounds alarming, given that the vast majority of consumer, commercial, and industrial IoT devices run on Linux-based platforms, directly or indirectly. Worryingly, the kernel's source tree runs to around 40 million lines of code, meaning there are likely still thousands more vulnerabilities waiting to be found.

However, the vast majority of documented CVEs are either low-priority or affect obsolete drivers and long-deprecated features.

The rise in AI-driven bug reports has had a silver lining for the kernel codebase too: earlier this year, maintainers cleared out a batch of old drivers, along with the entire ISDN subsystem, that had been harboring dozens of CVEs.

Linus Torvalds flagged the problem in his Linux 7.1-rc4 release post this past May, warning that the kernel's private security mailing list had become "almost entirely unmanageable." Kernel maintainers have said report volume has climbed from around 2-3 per week two years ago to 5-10 every day in 2026.