The Linux Kernel Is Approaching 2,000 CVEs Per Release (phoronix.com)
(Sunday August 30, 2026 @11:34AM (EditorDavid)
from the battling-bugs dept.)
[1] Phoronix reports on Greg Kroah-Hartman's recent slide from his upcoming talk in Paris at Kernel Recipes 2026 (September 21 to 23):
> With the proliferation of AI/LLM models analyzing the Linux kernel's vast codebase, there has been a surge in the number of CVEs per kernel release. After typically being around 500 CVEs fixed per release, we are now approaching 2,000 CVEs fixed per release and perhaps will break that threshold for Linux 7.3... Fortunately, most often they end up being lower priority vulnerabilities and often within old/obscure driver code, so the impact is often minimal.
[1] https://www.phoronix.com/news/Linux-Kernel-CVEs-Nearly-2000
> With the proliferation of AI/LLM models analyzing the Linux kernel's vast codebase, there has been a surge in the number of CVEs per kernel release. After typically being around 500 CVEs fixed per release, we are now approaching 2,000 CVEs fixed per release and perhaps will break that threshold for Linux 7.3... Fortunately, most often they end up being lower priority vulnerabilities and often within old/obscure driver code, so the impact is often minimal.
[1] https://www.phoronix.com/news/Linux-Kernel-CVEs-Nearly-2000