The number of CVEs fixed in each Linux kernel release is climbing fast. Not long ago, a release closed about 500. Now the count is nearing 2,000. Greg Kroah-Hartman teased the trend before his Kernel Recipes 2026 talk. He posted a slide charting CVEs per release. The event runs September 21–23 in Paris.
The slide covers Linux 7.2 back to Linux 6.9. From 6.9 through 6.19, releases averaged around 500 CVEs each. Then the curve bent upward. Since Linux 7.0, every release has topped one thousand. Linux 7.2 pushed past 1,500. If the trend holds, Linux 7.3 could break 2,000.
So what changed? AI is the short answer. LLMs are now scanning the kernel’s huge codebase for flaws. They surface issues faster than humans ever could. Each one that qualifies becomes a CVE. More eyes—even artificial ones—mean more reported vulnerabilities.
There’s plenty left to find. The kernel source is around 40 million lines. That’s a vast surface for automated tools to comb. So the count may keep rising for a while.
The headline number sounds alarming. The reality is milder. Most of these findings are lower priority. Many sit in old or obscure driver code. So the real-world impact is often small. A big CVE count doesn’t mean the kernel suddenly got less safe.
The AI wave has a useful side effect, too. The flood of bug and security reports has pushed maintainers to act. This year they’ve cleared out lots of obsolete kernel code. Removing dead code shrinks the attack surface. It also cuts future noise.
Greg Kroah-Hartman’s full talk lands at Kernel Recipes 2026. The teaser already makes the point clear. AI is reshaping how kernel security gets measured.
FAQ
How many CVEs does a kernel release fix now? Recent releases top 1,000. Linux 7.2 passed 1,500, and 7.3 could break 2,000.
What used to be normal? About 500 per release, from Linux 6.9 through 6.19.
Why the sudden jump? AI and LLMs are scanning the codebase and surfacing far more flaws than before.
See also: Mastering the Linux Command Line — Your Complete Free Training Guide
Does this mean the kernel is less secure? Not really. Most findings are low priority, often in old or obscure driver code.
Is there any upside? Yes. The report flood has pushed maintainers to remove obsolete code, shrinking the attack surface.
Where did this data come from? A slide Greg Kroah-Hartman shared ahead of his Kernel Recipes 2026 talk.
