Torvalds says AI patch flood may be peaking, The Register reports

What happened

According to The Register, Linus Torvalds says the worst of the AI-driven flood of patches may be behind the Linux kernel project. The Register reports that Torvalds wrote this in his weekly kernel update post, which accompanied Linux 7.4 rc2, the second release candidate of the next kernel. The Register

The Register says Torvalds rated rc2 as a big release for two reasons. First, he left some code out of rc1, and rc1 was already the largest such release in kernel history. Second, rc2 contains what he called “various AI fixes”. The Register

The Register quotes Torvalds as writing that Alexei Starovoitov “claims that on the bpf side at least the fixes are now coming in faster than the new reports”. Starovoitov is described by The Register as co-creator and lead developer of eBPF. Torvalds is quoted as adding that he thinks most other areas have not reached that point yet, but that it is a sign the tide “may” be starting to turn. He is also quoted as saying “Don’t hold your breath”. The Register

For context, The Register says patch volumes have grown since Anthropic launched its Mythos bug-finding model in April. It cites Microsoft’s record 974 flaws fixed in September and Oracle’s 1,449 flaws fixed in a single month. The Register

Not confirmed: the eBPF trend is Starovoitov’s claim as relayed by Torvalds, and no independent data on report or fix rates is given. Torvalds himself says other kernel areas have not reached that point. No CVE, affected version or fixed version is named in the source.

Am I affected?

This is a trend report, not a vulnerability disclosure. The source names no specific flaw, product version or exploit, so there is nothing to check your systems against.

Anyone who runs the Linux kernel or consumes kernel updates from a distribution or vendor is in the group that handles these fixes. The Register says IT teams must find ways to deal with bugs more quickly because attackers are increasingly targeting flaws found by AI. It does not describe a specific attack in this article.

What to do now

1. Keep applying kernel and vendor security updates on your normal schedule. The source does not say patch volume has fallen outside the eBPF area.
2. Do not reduce patching capacity based on this report. Torvalds himself says “Don’t hold your breath”.
3. Watch the Linux 7.4 release candidates and your distribution’s advisories for further statements on fix and report rates. Nothing beyond rc2 is confirmed in the source.

Sources

• The Register: Linus Torvalds sees signs AI-prompted patch flood has peaked