Linus Torvalds says the flood of patches prompted by AI-powered bug-finding tools may be starting to turn, citing Alexei Starovoitov’s claim that, in eBPF, fixes are coming in faster than new reports.
Writing in his weekly kernel update post while releasing Linux 7.4 release candidate 2, Torvalds rated the second rough cut of the next kernel as a big release for two reasons. One was that he left some code out of rc1 because he was busy and because it was already the largest such release in kernel history. The other was what Torvalds described as "various AI fixes."
The need for such fixes follows the launch of Anthropic's Mythos bug-finding model in April, which has enabled developers to find more software flaws than previously possible. Microsoft addressed a record 974 flaws in September, its third record fixing spree this year, while Oracle addressed 1,449 flaws in a single month. The volume of patches is more than IT teams are set up to handle, and attackers are increasingly targeting flaws found by AI.
Torvalds' post suggested that perhaps the worst is behind. "This time around Alexei claims that on the bpf side at least the fixes are now coming in faster than the new reports, and that sounds lovely if true," he wrote, referring to Alexei Starovoitov, co-creator and lead developer of the Extended Berkeley Packet Filter (eBPF) project. "I think most other areas haven't reached that point yet, but it's at least a sign that we may be starting to see the tide starting to turn. Don't hold your breath, but maybe cross your fingers we'll be getting there in the not entirely distant future."
With the Linux kernel containing more than 40 million lines of code, if AI soon stops finding flaws in other parts of the kernel beyond eBPF, the deluge of fixes developers and users will need to handle may have peaked.
Analysis
Why This Matters
- Every patch that needs to be reviewed, tested and deployed costs developer time and carries risk of regression; an AI-driven surge across the industry has already strained security teams.
- If the flaw-discovery rate is peaking, organisations may soon get breathing room to catch up on existing vulnerabilities instead of chasing new ones.
- The Linux kernel is the foundation of most cloud infrastructure, servers and Android devices; a stable kernel matters to the entire internet.
Background
Linus Torvalds is the creator and long-time lead developer of the Linux kernel. Since April 2026, when Anthropic released its Mythos bug-finding model, the rate of publicly reported vulnerabilities has risen sharply as AI tools uncover flaws faster than human reviewers. Major vendors including Microsoft and Oracle have posted record numbers of monthly patches. The resulting workload has been described as a "patchpocalypse" in industry commentary. The Extended Berkeley Packet Filter (eBPF) allows sandboxed programs to run inside the kernel and is one of the subsystems most affected.
Key Perspectives
Linus Torvalds: Notes that Starovoitov says on the eBPF side fixes are now coming faster than new reports, calling that "lovely if true" and a sign the tide may be starting to turn, though he cautions that most other areas have not reached that point.
Alexei Starovoitov (eBPF co-creator, as reported by Torvalds): Claims that fixes in the BPF area are now outpacing new bug reports.
What to Watch
- Whether other kernel subsystems follow eBPF in reaching a point where fix rates match or exceed discovery rates.
- The size of the next few Linux kernel release candidates: smaller rc's would indicate fewer outstanding patches.
- Whether the trend extends beyond the Linux kernel to major enterprise software projects where AI bug-finding has been adopted.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedThe AI-prompted patch flood may have peaked.www.theregister.com - Articles: “If AI soon stops finding flaws in other parts of the kernel beyond eBPF, perhaps the deluge of fixes developers and users alike will need to handle has peaked.”
- SupportedTorvalds says the tide may be starting to turn, citing Alexei Starovoitov’s claim that eBPF fixes are arriving faster than new reports.www.theregister.com - Articles: ““This time around Alexei claims that on the bpf side at least the fixes are now coming in faster than the new reports, and that sounds lovely if true,” he wrote.”
- SupportedTorvalds wrote in his weekly kernel update post while releasing Linux 7.4 rc2.www.theregister.com - Articles: “Writing in his weekly kernel update post, the Linux kernel dev leader delivered Linux 7.4 rc2 – the second rough cut of the next kernel”
- SupportedTorvalds said he left code out of rc1 because he was busy and because rc1 was already the largest such release in kernel history.www.theregister.com - Articles: “One is that he left some code out of rc1, because he was busy and because it was already the largest such release in the history of the kernel.”
- SupportedTorvalds described the other reason as “various AI fixes.”www.theregister.com - Articles: “The other is what Torvalds described as “various AI fixes.””
- SupportedAnthropic launched its Mythos bug-finding model in April, enabling developers to find more software flaws than before.www.theregister.com - Articles: “Such fixes are necessary because ever since Anthropic launched its Mythos bug-finding model in April, developers have been able to find more software flaws than was previously possible.”
- SupportedMicrosoft addressed a record 974 flaws in September.www.theregister.com - Articles: “Microsoft, for example, addressed a record 974 flaws in September”
- SupportedSeptember was Microsoft’s third record fixing spree that year.www.theregister.com - Articles: “– its third record fixing spree this year after it whacked 622 flaws in July and 206 in June.”
- SupportedOracle addressed 1,449 flaws in a single month.www.theregister.com - Articles: “Oracle addressed 1,449 flaws in a single month.”
- SupportedThe volume of patches exceeds what IT teams are set up to handle.www.theregister.com - Articles: “That’s many more patches than IT teams are set up to handle”
- SupportedAttackers are increasingly targeting flaws found by AI.www.theregister.com - Articles: “attackers are increasingly targeting flaws found by AI.”
- SupportedThe Linux kernel contains more than 40 million lines of code.www.theregister.com - Articles: “The Linux kernel’s 40-million-plus lines of code makes it one of the world’s bigger software projects.”
