// ZDNET — INTELLIGENZA ARTIFICIALE
‘We need more reviewers’: Finding Linux bugs is easy now – fixing them is another story
Some Linux maintainers are quitting under the crushing strain of AI bug reports, while others see signs for hope.
Recently, Microsoft’s FORGE Lab reported that its AI scanning system, MDASH, turned up 59 upstream Linux kernel bug reports, including one flaw at least 21 years old. That’s less impressive than it sounds. For 2026, through Nov. 2, the Linux Common Vulnerabilities and Exposures (CVEs) team reported an average of 27 CVEs a day.
Why so many? Easy: in Linux, any bug can be a security bug. As Linux Torvalds told me in 2024, “Bugs will happen, and anything can be a security bug if somebody is clever enough to just figure out how to abuse it.” Besides, since Linux runs everything from smartphones to refrigerators to supercomputers, what may be a serious bug in one device may not even appear at all on another.
It’s not just Linux, though. In the latest Windows Patch Tuesday security release, Microsoft reported 726 CVEs. The vast majority of these bug reports are coming from AI programmers. Finding bugs on anything is no longer the hard part. But reviewing and fixing them is, and both Microsoft developers and kernel maintainers are struggling to keep up.
Also: Microsoft fixes over 1,000 Windows flaws – and one is being exploited
As the FORGE Lab said, “Finding bugs and fixing them are drastically out of balance.” Turning its findings into reports took more than four person-months because “human effort [is] the bottleneck.”
That’s hurting the overworked maintainers. On Nov. 10, an ARM engineer and Linux kernel maintainer Lorenzo Stoakes gave up reviewing code. He’d been a reviewer for the memory-management core, misc, reclaim, and Rust-related sections. Stoakes, a kernel contributor since 2014, wrote, “Given the current throughput in the kernel resulting from AI-generated series, I unfortunately lack the bandwidth to generally be able to offer review except in those areas I maintain.”
Stoakes added, “Of course the AI wave has been horrible, and is getting significantly worse. At first it was once in a while that I’d see slop. Then it was at least once a week. Then every few days. Nowadays it’s pretty much half of what I see, if not more.”
Also: Filing bugs for open-source apps is a huge help for devs – and easier than you think
He’s not alone. As Greg Kroah-Hartman, the Linux kernel stable maintainer, said in a Q&A session at Open Source Summit Europe, “We don’t have enough people to review them, the onslaught of the LLM-generated patches. We need more reviewers. We don’t have enough. All of the maintainers are burnt out, and we have been for ten years.”