Linux Kernel Faces Over 2,000 CVEs Per Release Due to AI-Driven Security Analysis

The article discusses the significant increase in Common Vulnerabilities and Exposures (CVEs) fixed in each Linux kernel release, driven by advancements in AI/LLM models analyzing the kernel’s vast codebase. Previously around 500 CVEs per release, the number is now approaching 2,000, with projections suggesting it may surpass this threshold for Linux 7.3. While most vulnerabilities are low-priority and reside in outdated or obscure driver code, the sheer volume raises concerns. The piece highlights how AI tools are aiding in identifying security issues, though critics argue that many reported CVEs are redundant or trivial, such as exploits requiring multiple root access methods. Discussions emphasize the need to balance AI’s role in enhancing security with addressing genuine threats. Contributors note that while AI helps detect vulnerabilities, the focus should shift to resolving historic issues before new ones emerge. The article also touches on community concerns about AI’s potential misuse and the importance of prioritizing critical security patches over noise.