AI Code Scans Overwhelm Linux Maintainers as CVE Fixes Approach 2,000
The number of CVE vulnerability fixes per Linux kernel release is rapidly climbing toward 2,000, largely driven by AI tools scanning legacy codebases. Open-source maintainers report feeling overwhelmed as up to half of incoming patches are low-priority, AI-generated code cleanups. While automated AI scanning uncovers long-hidden bugs in obscure software modules, the massive influx of minor patches strains the finite human review capacity of open-source maintainers. This dynamic is pushing the Linux project to aggressively prune tens of thousands of lines of legacy driver code for obsolete hardware. During the Linux 7.3 development cycle, network subsystem maintainer Jakub Kicinski revealed that up to half of 648 net-next patches were low-priority AI modifications. To alleviate this strain, developers like Andrew Lunn have proposed removing roughly 28,000 lines of legacy networking code for outdated ISA and PCMCIA architectures.
## BACKGROUND
A Common Vulnerabilities and Exposures (CVE) entry is a standardized identifier assigned to a publicly disclosed cybersecurity flaw in software. The Linux kernel codebase spans nearly 40 million lines, which includes many legacy device drivers that rarely receive manual code reviews.