Linux kernel CVE fixes surge toward 2,000 per release due to AI scanning

The number of Common Vulnerabilities and Exposures (CVEs) addressed per Linux kernel release is experiencing a dramatic surge, driven largely by the widespread use of AI-powered code scanning tools. While the Linux 6.x series averaged approximately 500 CVE fixes per release, recent data shows a sharp upward trajectory: Linux 7.0 exceeded 1,000, Linux 7.2 surpassed 1,500, and the upcoming Linux 7.3 is projected to approach 2,000.

Maintainers report that this spike is a byproduct of AI tools scanning vast, obscure sections of the 40-million-line codebase, uncovering genuine defects in legacy drivers that previously escaped human scrutiny. However, the influx has also created significant overhead. Maintainers have noted that a substantial portion of AI-generated findings consist of low-priority fixes, minor code cleanups, or even “hallucinated” vulnerabilities.

In response to the volume of AI-assisted contributions, the development community is implementing new policies requiring human verification. To manage the noise, the stable kernel team is also utilizing AI models to review patches and filter out false positives, effectively using artificial intelligence to moderate the output of other AI tools.