Technology
Linux Kernel Nears 2,000 Reported Vulnerabilities Per Release Driven by AI Code Analysis
Automated tools and AI models are uncovering a surge in lower-priority security flaws across kernel updates.
The short version
- The Linux kernel is approaching 2,000 Common Vulnerabilities and Exposures (CVEs) fixed per release, up from a historical average of roughly 500.
- Maintainers attribute the rapid increase in vulnerability reports to the widespread use of AI and LLM tools scanning the codebase.
- Most identified flaws are low priority and located in obscure or legacy driver code, presenting minimal real-world risk.
Key facts
- A presentation slide prepared by maintainer Greg Kroah-Hartman for the Kernel Recipes 2026 conference shows the Linux kernel approaching 2,000 fixed CVEs per release.[Slashdot]
- The typical number of CVEs fixed in prior Linux kernel releases averaged around 500.[Slashdot]
- The influx of reported security issues is attributed to automated AI and large language model code analysis tools.[Slashdot]
- The majority of the newly reported flaws affect older or lesser-used drivers and carry a low priority rating.[Slashdot]
What remains uncertain
- It remains uncertain whether the Linux 7.3 release will officially cross the 2,000 fixed CVE threshold.[Slashdot]