The Linux Kernel Is Approaching 2,000 CVEs Per Release

The Linux kernel is approaching 2,000 CVEs fixed per release, up from around 500, according to Greg Kroah-Hartman, a leading Linux kernel maintainer, in a slide for his upcoming talk at Kernel Recipes 2026 in Paris (September 21-23). The surge is attributed to the proliferation of AI/LLM models analyzing the kernel's codebase, though most are lower-priority vulnerabilities often in old or obscure driver code.

Phoronix reports on Greg Kroah-Hartman's recent slide from his upcoming talk in Paris at Kernel Recipes 2026 September 21 to 23 : With the proliferation of AI/LLM models analyzing the Linux kernel's vast codebase, there has been a surge in the number of CVEs per kernel release. After typically being around 500 CVEs fixed per release, we are now approaching 2,000 CVEs fixed per release and perhaps will break that threshold for Linux 7.3... Fortunately, most often they end up being lower priority vulnerabilities and often within old/obscure driver code, so the impact is often minimal. Read more of this story https://linux.slashdot.org/story/26/08/29/0547248/the-linux-kernel-is-approaching-2000-cves-per-release?utm source=rss1.0moreanon&utm medium=feed at Slashdot.