Linux Maintainers Drowning in AI Bug Reports, Need Reviewers

Finding bugs in the Linux kernel has become easy. Fixing them has not. According to ZDNET, which reported on the situation on 12 November 2026, AI tools now generate so many bug reports and patches that the people who must review them are running out of energy, and at least one well-known kernel maintainer has stopped reviewing most code altogether.

A CVE (Common Vulnerabilities and Exposures) is the public identifier given to a documented security flaw. A maintainer is a volunteer or employee who owns a part of the kernel and decides which patches get merged. A reviewer is the person who reads a proposed patch and checks that it is correct before it goes in. The Linux kernel, the core of the operating system that runs everything from smartphones to supercomputers, depends on a small number of such people.

How big is the flood of Linux bug reports?

According to ZDNET, the Linux CVE team reported an average of 27 CVEs a day for 2026 through 2 November. ZDNET explains the volume partly by a kernel-specific rule: in Linux, any bug can potentially be a security bug.

According to Tom's Hardware, which relayed a 28 August report from Phoronix, the kernel is approaching 2,000 CVEs fixed per release, against roughly 500 through much of the Linux 6.x era. A slide from stable-kernel maintainer Greg Kroah-Hartman, prepared for the Kernel Recipes 2026 conference, showed counts above 1,000 with Linux 7.0 and above 1,500 with Linux 7.2. If the trend continues, Linux 7.3 could exceed 2,000, according to Tom's Hardware.

Tom's Hardware attributes the spike mainly to people using AI tools to scour a source tree that has grown past 40 million lines over 35 years, not to a sudden drop in the kernel's quality. Those tools reach obscure corners that humans rarely revisit, and they occasionally find genuine defects: Linux CVE records this year already credit AI-assisted static analysis with findings later confirmed by Intel Product Security.

The ZDNET article adds a figure from the corporate side. Microsoft's FORGE Lab said its AI scanning system, MDASH, produced 59 upstream Linux kernel bug reports, including one flaw at least 21 years old. According to the lab, turning those findings into reports took more than four person-months because human effort is the bottleneck, and it described finding and fixing bugs as drastically out of balance. On the Windows side, ZDNET notes that the latest Patch Tuesday included 726 CVEs, most of them coming from AI-driven discovery.

Why are kernel maintainers burning out?

The strain is visible in named cases. According to ZDNET, on 10 November 2026 ARM engineer and kernel maintainer Lorenzo Stoakes stopped reviewing code in the memory-management core, misc, reclaim and Rust-related sections, areas he had covered as a reviewer. He has contributed to the kernel since 2014. He wrote that, given the throughput of AI-generated patch series, he can no longer offer general review except in the areas he maintains himself. He added that AI-generated slop once appeared occasionally, then weekly, then every few days, and is now about half of what he sees or more.

Greg Kroah-Hartman, the stable-kernel maintainer, said the same thing at a Q&A session at Open Source Summit Europe, according to ZDNET: there are not enough people to review the onslaught of LLM-generated patches, and the maintainers have been burnt out for ten years. His request was direct: the kernel needs more reviewers.

Tom's Hardware gives a measurable example from networking. In the Linux 7.3 networking pull request, maintainer Jakub Kicinski estimated that between one third and one half of the 648 net-next patches handled in the cycle looked like low-priority fixes, clean-ups or clarifications driven by AI. He wrote that the team is completely overwhelmed.

The workload is changing what the kernel keeps. According to Tom's Hardware, developer Andrew Lunn proposed in April to remove nearly 28,000 lines of legacy networking code for old ISA and PCMCIA-era hardware, because AI and fuzzing tools started finding defects that maintainers felt obliged to fix even if nobody runs the hardware. Linux 7.3 is removing old SGI and IBM driver code, and the FreeVxFS filesystem driver was dropped after its maintainer said the old compatibility code mostly served as fodder for automated bug checkers.

Is the kernel community rejecting AI?

No, and Tom's Hardware is explicit on this point. Kroah-Hartman himself has used locally run, AI-assisted fuzzing tools to find kernel bugs. The complaint concerns unverified AI output handed to humans to validate. According to Tom's Hardware, he recently barred LLM-generated patches from the kernel's staging subsystem except for legitimate security fixes, and updated kernel guidance warns that AI-generated reports submitted without human verification can waste maintainers' time. The team has also secured access to several frontier models to help review patches and filter out hallucinated results.

Are fixes starting to catch up with reports?

There are early signs, but nothing conclusive. According to ZDNET, Linus Torvalds wrote in a message on the Linux Kernel Mailing List that much of the new code in Linux 7.4-rc2 was driven by AI fixes. He said that on the BPF side at least, fixes are now arriving faster than new reports, that most other areas have not reached that point, and that it may be a sign the tide is turning. His advice was not to hold your breath.

Kroah-Hartman is less optimistic. He told ZDNET that the project is getting closer but is not there yet, and he declined to estimate when human-approved AI fixes will overtake AI bug reports. Daniel Stenberg, creator of the cURL project and an outspoken critic of low-quality AI reports, told ZDNET he believes his project manages the flood fairly well so far, even if volume goes up and down depending on who sends new findings in a given week.

• 27 CVEs a day: the Linux CVE team's average through 2 November 2026, according to ZDNET.
• Close to 2,000 CVEs per kernel release, against about 500 in much of the 6.x era, according to Tom's Hardware.
• One third to one half of 648 networking patches in the Linux 7.3 cycle judged low-priority AI-driven work, according to maintainer Jakub Kicinski.

What does this change for a company?

For a US company that runs Linux on servers, containers, network gear or embedded devices, the practical lesson is that the number of kernel advisories will keep rising while the humans behind each fix stay scarce. A CVE count by itself says little about risk, since many of the new entries concern obscure drivers; what matters is which of them affect the hardware and kernel configuration you actually run.

Three habits follow from this. Track the stable kernel releases your distribution ships and shorten the time you take to apply them. Maintain an inventory of the kernel features and drivers you enable, so that you can triage advisories quickly. And if your team files bug reports with AI assistance, have a person reproduce each issue first, because the maintainers' own guidance says unverified reports waste their time. Companies that depend on Linux can also help directly by funding or contributing reviewer time, the resource that, according to Kroah-Hartman, is in shortest supply.

One caveat: the sources do not say when fixes will outpace reports, and Torvalds' observation about BPF is described as encouraging but limited to that area. Treat the current period as a heavy patching season, not as a settled trend.