ZDNET’s key takeaways
- Microsoft discovered some Linux kernel issues.
- Due to AI, Linux and Home windows wrestle with growing bug studies.
- Maintainers are stretched however there are indicators of hope.
Not too long ago, Microsoft’s FORGE Lab reported that its AI scanning system, MDASH, turned up 59 upstream Linux kernel bug studies, together with one flaw at the least 21 years previous. That’s much less spectacular than it sounds. For 2026, via Nov. 2, the Linux Widespread Vulnerabilities and Exposures (CVEs) crew reported a mean of 27 CVEs a day.
Why so many? Straightforward: in Linux, any bug could be a safety bug. As Linux Torvalds instructed me in 2024, “Bugs will occur, and something could be a safety bug if someone is intelligent sufficient to simply work out easy methods to abuse it.” Moreover, since Linux runs the whole lot from smartphones to fridges to supercomputers, what could also be a severe bug in a single machine might not even seem in any respect on one other.
It’s not simply Linux, although. Within the newest Home windows Patch Tuesday safety launch, Microsoft reported 726 CVEs. The overwhelming majority of those bug studies are coming from AI programmers. Discovering bugs on something is not the laborious half. However reviewing and fixing them is, and each Microsoft builders and kernel maintainers are struggling to maintain up.
Additionally: Microsoft fixes over 1,000 Home windows flaws – and one is being exploited
Maintainers breaking beneath the pressure
That’s hurting the overworked maintainers. On Nov. 10, an ARM engineer and Linux kernel maintainer Lorenzo Stoakes gave up reviewing code. He’d been a reviewer for the memory-management core, misc, reclaim, and Rust-related sections. Stoakes, a kernel contributor since 2014, wrote, “Given the present throughput within the kernel ensuing from AI-generated sequence, I sadly lack the bandwidth to typically have the ability to supply assessment besides in these areas I preserve.”
Stoakes added, “After all the AI wave has been horrible, and is getting considerably worse. At first it was occasionally that I’d see slop. Then it was at the least as soon as per week. Then each few days. These days it’s just about half of what I see, if no more.”
Additionally: Submitting bugs for open-source apps is a big assist for devs – and simpler than you suppose
He’s not alone. As Greg Kroah-Hartman, the Linux kernel secure maintainer, mentioned in a Q&A session at Open Supply Summit Europe, “We don’t have sufficient folks to assessment them, the onslaught of the LLM-generated patches. We want extra reviewers. We don’t have sufficient. All the maintainers are burnt out, and we’ve got been for ten years.”
Can AI remedy the issue it’s created?
It’s not all doom and gloom, although. Linux Torvalds, Linux’s creator, mentioned in a latest Linux Kernel Mailing Record (LKML) message that a lot of the brand new code within the Linux 7.4 rc 2 “was pushed by numerous AI fixes.”
He continued, “that on the bpf [Berkeley Packet Filter]- aspect at the least the fixes at the moment are coming in sooner than the brand new studies, and that sounds beautiful if true. I believe most different areas haven’t reached that time but, but it surely’s at the least an indication that we _may_ be beginning to see the tide beginning to flip. Don’t maintain your breath, however perhaps cross your fingers we’ll be getting there within the not completely distant future.”
We will however hope. In an interview, Kroah-Hartman isn’t so optimistic. “We’re getting nearer, sure, however not fairly there but.” He’s not even prepared to present a guesstimate of when human-approved AI fixes will meet up with and overcome AI bug studies.
Additionally: I locked down my OpenClaw agent with Claude Code – then dared it to flee
Daniel Steinberg, the creator of the open-source cURL mission, can also be cautiously optimistic. Steinberg, who’s been particularly vital of AI slop bug studies, instructed me in an interview that he now believes “we handle the flood fairly effectively to date, even when it goes a bit of up and down in durations relying precisely on who sends us a brand new set of findings this explicit week.”
Nonetheless, whereas AI bugs stay a serious headache for now, AI bug fixes, together with the work of 1000’s of maintainers, might lastly be beginning to stem the AI bug flood. I nonetheless foresee lengthy days and nights of labor forward.
I additionally anticipate we’ll see extra severe safety breaches. In November alone, we noticed a severe Linux TCP networking safety gap revealed; the nasty Alpine Linux OpenSSH flaw; Alpine’s GitLab near-miss; and the wide-open PHP2Shell safety drawback, which many teams nonetheless haven’t patched.
See full bio
