AI Floods Linux Kernel With Security Vulnerability Reports

The Linux kernel is more than thirty years old, but only now are its maintainers admitting they can't keep up with reviewing vulnerability reports. The reason is no secret: AI models are combing through kernel code at a scale no team of human reviewers could ever match, and the number of reported CVEs is climbing from release to release at a pace that has surprised even Linus Torvalds himself.

A Flood of Reports

The Linux kernel became its own CVE Numbering Authority (CNA) in February 2024, which alone sped up the process of assigning numbers to vulnerabilities found in the code. But the real jump came when language models and automated security-auditing platforms started being used to review code en masse. Between releases 6.9 and 6.19, the number of reported vulnerabilities hovered around 500 per release. Starting with version 7.0 it jumped to about 1,000, and with Linux 7.2 it passed 1,500. According to estimates cited by Tom's Hardware, release 7.3 could approach 2,000 reports.

Torvalds on an Unmanageable List

Linus Torvalds addressed the problem directly in the announcement accompanying the release of Linux 7.1-rc4 in May 2026, referring to a private mailing list dedicated to kernel security. Two years earlier, that list received 2-3 reports a week. In 2026, that number rose to 5-10 reports a day.

Almost entirely unmanageable - Linus Torvalds, creator of the Linux kernel

Scale Without Code Growth

Greg Kroah-Hartman, one of the lead maintainers of the kernel's stable releases, presented data showing the exponential growth in the number of detected vulnerabilities at the Kernel Recipes 2026 conference in Paris. Developer Karthick Palanisamy pointed out the paradox at the heart of the situation: the kernel's codebase itself hasn't grown in proportion to the number of reports, while models such as China's GLM-5.3 from Z.ai have independently identified more than a thousand critical vulnerabilities in open-source projects, including Linux.

The codebase itself hasn't grown to match. It's still roughly 34 million lines of C. AI-assisted tools are now scanning kernel code at a scale no human review process was ever built for - Karthick Palanisamy, developer

Duplicates and False Alarms

Experts cited in Western trade media stress that raw CVE counts are misleading about the real scale of the threat. A large share of the reports concern outdated drivers, long-abandoned kernel features, or low-priority bugs that pose no practical risk to a typical user or server administrator. AI tools also flag duplicates of the same issue under different numbers, as well as vulnerabilities so difficult to exploit that they remain purely theoretical. Only about 0.25 percent of CVEs reported this way have documented evidence of actual use in attacks.

The Other Side of the Coin

The growing number of detected vulnerabilities isn't just an organizational headache for kernel maintainers. Security experts warn that the same AI models finding the vulnerabilities are increasingly able to turn them into ready-made exploit chains. Dvir Sasson of Zest Security notes that the cost of turning a discovered flaw into a working attack is steadily falling month over month, and that modern frontier models can assist with every stage of that process.

None of that is going to slow down, and the part that turns this volume into working attacks is getting cheaper by the month - Dvir Sasson, VP of AI and Security Research, Zest Security

What This Means for Administrators

For companies and administrators running Linux-based systems, which account for the vast majority of the world's servers, cloud infrastructure, and embedded devices, this calls for a shift in how vulnerability management is approached. Relying on a simple CVE count as a measure of a system's security stops making sense when the number of reports multiplies several times over without a proportional rise in real risk. What matters more is prioritizing patches based on actual exploitability and the importance of a given component in a specific environment, rather than its mere presence in the CVE database.

The Linux kernel contains roughly 34-40 million lines of C code, making it one of the largest and longest-running open-source projects in the world. At that scale, experts acknowledge that AI tools have probably uncovered only a fraction of the problems that actually exist, and the question is whether the community can work out a way to filter reports before the wave grows even larger with the next generation of increasingly capable models.