The Linux Kernel Is Nearing 2,000 CVEs per Release — Blame the Neural Nets

The number of CVEs fixed in each Linux kernel release is climbing fast — and artificial intelligence is being named as the main culprit. Whereas a release used to account for roughly 500 patched vulnerabilities, that figure is now approaching 2,000, and it's quite possible the threshold will be crossed as early as Linux 7.3.

Ahead of the Kernel Recipes 2026 conference, to be held in Paris from September 21 to 23, Greg Kroah-Hartman shared a preview of his forthcoming talk. The published slide charts CVE trends by release — from the recent Linux 7.2 back to Linux 6.9. Across the 6.9 to 6.19 range, an average of about 500 vulnerabilities were fixed per release, whereas from Linux 7.0 onward the count ran into the thousands. Another jump came with Linux 7.2, where the bar climbed past 1,500. If generative AI keeps up the pace, breaking the 2,000 mark is only a matter of time.

Lots of code, lots of findings

With the kernel source tree running to roughly 40 million lines, language models have more than enough ground to comb through. The reassuring part is that the vast majority of the problems turned up are low-priority and buried in old or obscure driver code, so the real-world impact is usually minimal.

This wave has a flip side, too: in the age of AI, the flood of bug reports and imagined vulnerabilities has become a noticeable burden. That said, this same stream has pushed developers this year toward a sweeping cleanup of stale kernel code — old drivers are being dropped in part because maintaining them and triaging the reports that come in about them is no longer worth the trouble.

The rising CVE count, then, reflects not so much a decline in the kernel's quality as a new reality: automated auditing has become cheap and widespread, and with it the very scale of what we now tend to record and fix has changed.

Source: Phoronix