Ai found the bugs faster than humans could triage them. kernel cves per release jumped from about…
ai found the bugs faster than humans could triage them. kernel cves per release jumped from about 500 to nearly 2,000, and maintainers now see 5-10 reports a day, most real and most low priority.
the bottleneck moved to attention.
Context
Phoronix (28 August 2026) reports Greg Kroah-Hartman showing a slide of Linux kernel CVEs per release: about 500 per release from 6.9 to 6.19, over 1,000 since 7.0, over 1,500 at 7.2, with surpassing two thousand likely imminent, and most being lower-priority issues in old or obscure driver code. Tom's Hardware (1 September 2026) relays it and quotes Jakub Kicinski estimating that a third to a half of 648 net-next patches in the 7.3 cycle looked like low-priority fixes or clean-ups driven by AI, saying maintainers are completely overwhelmed. The Register (26 March 2026) quotes Kroah-Hartman saying AI reports shifted from slop to real reports and that the increase is real, mostly tiny things.
The CVE counts are secondary reports of a maintainer's slide, which was not seen, and Phoronix says approaching 2,000 while nearly 2,000 is Tom's Hardware's wording. Five to ten reports a day was not found in the three sources read. Most real and most low priority is supported only qualitatively. Found the bugs faster than humans could triage is the note's framing, since the sources say maintainers are overwhelmed but give no measured rate, and no comparison of AI against human discovery speed. CVEs per release counts published fixes and is not a speed measure.
Watch next
- Kroah-Hartman's Kernel Recipes talk and the source for the daily report figure.
Sources
- Linux kernel CVEs nearly 2,000 per release (Phoronix, 28 Aug 2026)phoronix.com
- Linux kernel nears 2,000 CVEs per release as AI bug hunters scour 40 million lines of code (Tom's Hardware, 1 Sep 2026)tomshardware.com
- Linux kernel czar says AI bug reports aren't slop anymore (The Register, 26 Mar 2026)theregister.com
Provenance
The note above is reproduced unedited from the original post, first published on Threads on 21 September 2026 at 18:16 IST. Sources are the papers and datasets the note draws on.
View the original post ↗Embed this note
More notes
The air is now being asked to keep its own ledger
the air is now being asked to keep its own ledger: ecmwf’s aifs compo becomes the first ai model to forecast atmospheric composition globally every three hours, cleanair simulates 365 days of pm2.5 over china in ten seconds, and a unified framework maps six pollutants at one kilometer across the whole country. the air now files its own composition report.
read the note →The current is now being asked to draw its own map
the current is now being asked to draw its own map: china’s langya 2.0 predicts six ocean phenomena including internal waves and mesoscale eddies, a deep net called wenhai resolves eddies globally with air sea flux formulas built in, and scripps infers surface currents from the way temperature patterns deform in satellite images. the ocean now files its own circulation report.
read the note →The soil is now being asked to report its own carbon
the soil is now being asked to report its own carbon: a nix color sensor paired with generative data augmentation predicts soil organic carbon without a lab, random forest drives 74 percent of soil health mapping studies, and sentinel 2 tracks five year carbon change across france and italy from 922 samples. the dirt now files its own carbon account.
read the note →