Linus Torvalds Sees Signs AI-Prompted Patch Flood Has Peaked

Linus Torvalds says he sees the first signs that the flood of AI-prompted patches may have peaked, though so far only in one part of the Linux kernel. Writing in his weekly kernel update post, he published Linux 7.4 rc2, the second rough cut of the next kernel, which he rated a big release for two reasons.

AI fixes and patch pressure

One is that he left some code out of rc1, because he was busy and because it was already the largest such release in the history of the kernel. The other is what Torvalds described as "various AI fixes."

Such fixes are necessary because ever since Anthropic launched its Mythos bug-finding model in April, developers have been able to find more software flaws than was previously possible. Microsoft, for example, addressed a record 974 flaws in September, its third record fixing spree this year after it whacked 622 flaws in July and 206 in June. Oracle addressed 1,449 flaws in a single month.

That is many more patches than IT teams are set up to handle, yet they must find ways to deal with bugs more quickly because attackers are increasingly targeting flaws found by AI.

eBPF signals a possible turn

Torvalds’ post suggests that, perhaps, the worst of this is behind us. "This time around Alexei claims that on the bpf side at least the fixes are now coming in faster than the new reports, and that sounds lovely if true," he wrote.

That is a reference to Alexei Starovoitov, co-creator and lead developer on the Extended Berkeley Packet Filter (eBPF), the project that makes it possible to run sandboxed programs within the Linux kernel. "I think most other areas haven’t reached that point yet, but it’s at least a sign that we may be starting to see the tide starting to turn," Torvalds added. "Don’t hold your breath, but maybe cross your fingers we’ll be getting there in the not entirely distant future."

Why it matters

If Torvalds is correct, that is welcome news. The Linux kernel’s 40-million-plus lines of code make it one of the world’s bigger software projects. If AI soon stops finding flaws in other parts of the kernel beyond eBPF, perhaps the deluge of fixes developers and users alike will need to handle has peaked.

Earlier coverage: We reported earlier that the kernel had left what Torvalds called its "stabilization phase" and was using a "much healthier model" for AI contributions: Linus Torvalds says Linux kernel is using a healthier model for AI contributions.

Sources: The Register