AI Bug Reports Overwhelm Linux Maintainers as Fixes Lag Behind

Microsoft's FORGE Lab reported on November findings that its AI scanning system, MDASH, surfaced 59 upstream Linux kernel bug reports, including one flaw at least 21 years old. The number sounds impressive. It is also a drop in the ocean. For 2026, through November 2, the Linux Common Vulnerabilities and Exposures (CVEs) team reported an average of 27 CVEs a day.

That average explains the real story. The bottleneck in kernel security has shifted. Finding bugs is no longer the hard part. Reviewing and fixing them is, and both Microsoft developers and Linux kernel maintainers are struggling to keep up, according to ZDNET's reporting on the growing strain.

Why does Linux produce so many security bugs?

The answer is structural. In Linux, any bug can be a security bug. Linus Torvalds, Linux's creator, told ZDNET in 2024: "Bugs will happen, and anything can be a security bug if somebody is clever enough to just figure out how to abuse it."

The context matters. Linux runs everything from smartphones to refrigerators to supercomputers. A bug that is serious on one device may not even appear on another. That breadth multiplies the surface area that automated scanners can sweep.

Microsoft's own ecosystem shows the same pattern. The latest Windows Patch Tuesday security release, as reported by Microsoft, covered 726 CVEs. The vast majority of these bug reports are now coming from AI programmers, according to the report. Microsoft recently fixed over 1,000 Windows flaws in one cycle, including one flaw that was being actively exploited.

Who is breaking under the strain?

The maintainers. On November 10, ARM engineer and Linux kernel maintainer Lorenzo Stoakes gave up general code review. He had been a reviewer for the memory-management core, misc, reclaim, and Rust-related sections. Stoakes, a kernel contributor since 2014, wrote: "Given the current throughput in the kernel resulting from AI-generated series, I unfortunately lack the bandwidth to generally be able to offer review except in those areas I maintain."

His account of the trend is specific. "Of course the AI wave has been horrible, and is getting significantly worse. At first it was once in a while that I'd see slop. Then it was at least once a week. Then every few days. Nowadays it's pretty much half of what I see, if not more."

He is not alone. Greg Kroah-Hartman, the Linux kernel stable maintainer, said in a Q&A session at Open Source Summit Europe: "We don't have enough people to review them, the onslaught of the LLM-generated patches. We need more reviewers. We don't have enough. All of the maintainers are burnt out, and we have been for ten years."

That statement carries weight beyond the AI moment. Kroah-Hartman dates the burnout back a decade, which places the current AI-driven surge on top of a reviewer shortage that predates large language models (LLMs, the AI systems that generate text and code).

Can AI fix the problem it created?

There are early signs it might, at least partially. Linus Torvalds said in a recent Linux Kernel Mailing List (LKML) message that much of the new code in Linux 7.4 rc 2 "was driven by various AI fixes."

Torvalds continued: "that on the bpf [Berkeley Packet Filter]- side at least the fixes are now coming in faster than the new reports, and that sounds lovely if true. I think most other areas haven't reached that point yet, but it's at least a sign that we may be starting to see the tide starting to turn. Don't hold your breath, but maybe cross your fingers we'll be getting there in the not entirely distant future."

The Berkeley Packet Filter (bpf) is a kernel subsystem that enables programmable packet filtering and tracing, and it is the first area where AI-generated fixes reportedly outpace AI-generated bug reports. Torvalds is careful. Most other subsystems, he says, have not reached that point.

Kroah-Hartman is more cautious still. In an interview, he said: "We are getting closer, yes, but not quite there yet." He declined even to give an estimate of when human-approved AI fixes would catch up with and overcome AI bug reports.

Daniel Steinberg, creator of the open-source cURL project (a widely used command-line tool for transferring data over network protocols), is cautiously optimistic. Steinberg has been especially critical of AI slop bug reports in the past. He told ZDNET in an interview that he now believes "we manage the flood pretty well so far, even if it goes a little up and down in periods depending exactly on who sends us a new set of findings this particular week."

What security incidents happened in November?

November alone brought a string of serious incidents, according to the report:

• A serious Linux TCP networking security hole was revealed.
• The Alpine Linux OpenSSH flaw emerged as a significant vulnerability.
• Alpine's GitLab experienced a near-miss.
• The wide-open PHP2Shell security problem remained unpatched by many groups.

Each incident underscores the stakes. Bug discovery at scale only improves security if someone reviews, accepts, and ships the fix before attackers act on the flaw.

What happens next?

The arithmetic defines the challenge. AI scanners generate reports at machine speed. Human reviewers approve fixes at human speed. The 27 CVEs per day average for 2026, through November 2, gives a concrete measure of the inflow, while Stoakes's November 10 departure from general review measures the outflow of reviewer capacity.

For now, AI bug fixes combined with the work of thousands of maintainers may be starting to stem the AI bug flood, but the reporter covering the story foresees long days and nights of work ahead. More serious security breaches are also expected, and the unpatched PHP2Shell problem shows how discovery without remediation leaves exposure open.

The bpf subsystem offers the one measurable positive signal. If fixes can outpace reports there, as Torvalds noted in his LKML message, other kernel areas may eventually follow. Until then, the reviewer shortage remains the choke point, and Kroah-Hartman's call for more reviewers stands as the industry's most direct ask.