The Linux kernel has approached 2,000 registered vulnerabilities per version, according to a report from Tom’s Hardware. The milestone was reached with the help of automated AI-based bug-hunting tools scanning 40 million lines of code.
Kernel maintainers said they are 'completely overwhelmed' by the volume of CVEs generated. Each new release brings a list of flaws that need triaging, fixing, and documenting, but the discovery pace exceeds the community’s ability to respond.
Automated AI scanning is cited as the main cause of the increase. Instead of finding dozens of flaws per release, the tools now generate hundreds of reports, many of which are false positives or low-severity bugs that still consume human time.
For those running Linux systems in production, this scenario poses a practical dilemma. Keeping the kernel always on the latest version becomes riskier because the volume of fixes grows without quality triage keeping pace. At the same time, ignoring updates increases exposure to real flaws.
The paper understands that automating bug hunting is inevitable, but the community needs to revise the triage pipeline before the number of CVEs makes maintenance unsustainable. Without that, the end user faces a choice between risk and constant rework.