Linux 7.4-rc2: Is the AI Bug Flood Finally Turning?

Linus Torvalds tagged Linux 7.4-rc2 on Sunday, November 8, and the weekly note that came with it had a line worth stopping on. He passed along a claim from BPF maintainer Alexei Starovoitov: in his corner of the kernel, fixes are now landing faster than new bug reports arrive. After months of AI-found bugs piling onto maintainers, that is a rare note of relief from the top.

Linus did not declare victory. He called it a sign the tide may be turning, said most other areas have not caught up with BPF, and told readers not to count on it yet.

Key points

Linux 7.4-rc2 is big, following the largest rc1 on record, but much of the diffstat is scripted Coccinelle noise.
Linus says AI-found fixes drove much of the rest, and he plans to stop mentioning it.
Alexei Starovoitov claims BPF fixes now outpace new reports. Linus says most other areas are not there yet.
The announcement includes no counts, so this is a promising signal, not a measured trend.

What Linus Torvalds said in the Linux 7.4-rc2 announcement

A big rc2 with a noisy diffstat

Linus opened by calling rc2 big, a fitting follow-up to the largest rc1 ever. Automated Coccinelle updates dominate the diffstat. They reached him during the merge window, and he held them for rc2 because he was on the road. By his own admission, he was in no hurry to deal with them after he got home, either.

Coccinelle is the semantic patching tool the kernel uses for mechanical cleanups. These updates are mostly one- and two-line edits spread across thousands of files, so they add noise to the diffstat without adding much risk. Linus calls them straightforward.

What the diffstat looks like without the noise

Mask the scripted changes and the shape changes. The diff no longer sprawls across thousands of files, and Linus says nothing about it looks unusual. He splits it into rough thirds:

Drivers: mostly GPU, networking and sound, with a little of everything else.
Networking and BPF: the second third.
The rest: mainly filesystems, memory management and architecture updates.

The paragraph about AI

Linus says much of rc2 was driven by AI-found fixes, and that he will stop repeating the point because everyone can take it for granted by now. Then comes the line that made headlines. He passes along Alexei’s claim that on the BPF side, fixes are arriving faster than new reports, which he calls welcome news if it holds.

He thinks most other areas have not reached that point, but says it is at least a sign that “we may be starting to see the tide starting to turn.” He closes with a warning to temper expectations, a hope that the rest of the kernel gets there before long, and a request to keep testing.

Why BPF may be the first corner of the kernel to turn

Alexei Starovoitov co-created eBPF and is one of the subsystem’s lead maintainers. He is also the top name in the rc2 shortlog with 40 commits, ahead of David Hildenbrand with 37 and Chris Mason with 33. Many of his patches harden the BPF verifier and arena code, and many ship with a matching selftest.

A fix that arrives with a test closes the bug and keeps it closed, which is how a subsystem gets ahead of its inbox. The subjects show the pattern: refusing to map an arena at address 0, invalidating a dynptr slice when its stack buffer is written, and so on down the list.

BPF also had a head start on AI review. According to The Register’s March report, Chris Mason, now at Meta, has run AI review on BPF and networking patches for some time. His prompts became the base for Sashiko, the open-source review system that Google engineer Roman Gushchin announced that same month. Bugs caught in review never turn into reports, which is a plausible reason BPF turned first, though Linus does not say so.

What the rc2 shortlog shows

The shortlog attached to the announcement lists hundreds of authors, and most appear once or twice. The long tail tells the story better than the top names do.

Memory management is well represented, with David Hildenbrand’s 37 patches covering shmem, huge pages, userfaultfd, mremap and KSM. Then the neglected corners show up. The 9p filesystem alone collected dozens of patches, and ocfs2, UDF, NTFS, ksmbd and the vhost and virtio drivers all got a steady stream of fixes. One contributor sent 14 patches split evenly between Bluetooth and ocfs2. Another sent 11 for a single hwmon sensor driver, chipcap2.

Verbs like fix, reject, validate and clamp show up constantly in the subject lines, which fits a release full of bounds checks and race fixes. What the shortlog does not show is which patches involved AI tools. With the Assisted-by tag gone, you cannot tell from the commits alone, which helps explain why the BPF claim rests on a maintainer’s experience and not on a dashboard.

How the kernel got here: a timeline of the AI bug wave

The last eight months explain why one line about BPF landed so hard.

March 2026: Greg Kroah-Hartman told The Register that something had shifted within the past month, and AI bug reports were arriving as real findings instead of noise.
April: The Register links the surge in discovered software flaws to that month’s launch of Anthropic’s Mythos bug-finding model.
May 17: With 7.1-rc4, Linus said duplicate AI reports had left the private security list close to unmanageable.
August: A slide from Kroah-Hartman showed kernel CVEs per release rising from roughly 500 in the 6.x era to more than 1,500 with Linux 7.2. Networking maintainer Jakub Kicinski estimated that a third to a half of the 648 net-next patches in 7.3 appeared to be low-priority AI-driven fixes or cleanups, and said the team was overwhelmed.
September: At Kernel Recipes, Kroah-Hartman’s message was not to panic: run local models, never upload non-public information to outside systems, and fix the bugs.
October: Maintainers dropped the Assisted-by disclosure tag after a summit in Prague. Sasha Levin’s changelog counted only about 10 percent of the 18,533 non-merge commits in Linux 7.3 through rc7 carrying it.
November 1: Linux 7.4-rc1 closed the biggest merge window on record, 19,671 commits against 16,267 for 7.3. Linus said he prefers AI-driven work landing in the merge window to seeing it arrive as extra fixes during the rc weeks.

Why fixes outpacing reports does not mean the bugs are gone

Treat the BPF claim as good news with an asterisk. Five things could make the crossover look better than it is.

It is one maintainer’s account. Linus relayed it secondhand, and the announcement includes no counts. With the Assisted-by tag retired, and only about one in ten commits using it before that, there is no easy public metric to check it against.
Reports can fall for reasons other than fewer bugs. Readers in the r/linux thread pointed out that people may have stopped sending reports, or that maintainers may have gotten faster at filtering noise.
The pool is large. On November 4, OpenAI said a research pipeline scanned the kernel in mid-October, reproduced 1,724 vulnerabilities and built working local privilege escalation exploits for 948 distinct bugs, each with a candidate patch. When the scan finished ten days later, 61 had been patched upstream, 43 had staging patches and 299 were being reported and discussed publicly. Humans reviewed the output before anything went to maintainers, and the rest is being reported in phases, so more reports are still coming. The figures are the company’s own.
New tools find new bugs. Commenters noted that every new bug-hunting tool finds a burst of easy bugs and then settles, while others expect each model generation to restart the cycle. Either way, a lull could be temporary. Google’s Sashiko, for one, has completed roughly 191,000 patch reviews and is cited in nearly 500 kernel CVEs.
Humans are still the bottleneck. Faster fixing raises the review load, and review is where mistakes slip through. Kicinski’s numbers from the 7.3 cycle show how much AI-driven churn maintainers already absorb.

What this means if you run Linux

Keep rc2 off machines you depend on. Release candidates are for testers. Use a spare machine or a virtual machine, and report regressions through the kernel’s normal channels.
Stay on a current stable kernel. The kernel team’s long-running advice is to upgrade to the latest release, because that is where known fixes land. With CVE counts per release at record levels, that advice carries more weight than usual.

What to watch before Linux 7.4 ships

The size of rc3 and rc4. If the BPF pattern spreads, later release candidates should shrink. If they stay large, the plateau has not arrived.
Other subsystems. Linus says most areas trail BPF. Memory management and networking, where the shortlog shows heavy traffic, are the places to look for the same claim.
New batches of reports. OpenAI says it is reporting the rest of its findings in phases, and other labs run similar pipelines. A fresh batch could reverse the BPF trend for a week or two.
The release date and LTS status. On a normal seven-rc schedule, rc7 lands December 13 and Linux 7.4 follows on December 20. An rc8 moves it to December 27. Linus says developers expect 7.4 to be the next long-term support kernel, which is one reason this cycle runs large, though nothing is confirmed.

The BPF claim is plausible, early and unmeasured. The size of rc3 through rc7 will say more than any announcement can.

Linux 7.4-rc2 and AI bug fixes: FAQ

What is Linux 7.4-rc2?

Linux 7.4-rc2 is the second release candidate for the Linux 7.4 kernel. Linus Torvalds released it on Sunday, November 8, 2026, one week after rc1. Only fixes are supposed to land from here, and a new release candidate follows each week until the final release.

What did Linus Torvalds say about AI bug fixes in 7.4-rc2?

He said much of rc2 was driven by AI-found fixes and that he will stop repeating the point. He also relayed a claim from BPF maintainer Alexei Starovoitov that BPF fixes now arrive faster than new bug reports. Linus called that a possible sign the tide is turning, but said most other areas have not reached that point.

Are AI bug fixes outpacing bug reports in the Linux kernel?

Only in BPF, and only by one maintainer’s account. Linus said most other areas are not there yet, and the announcement includes no counts. Treat it as an encouraging signal, not a measured trend.

Is AI finding real bugs in the Linux kernel?

Yes, at scale. Greg Kroah-Hartman said in March that AI reports had shifted from junk to real, and Google’s Sashiko review system has been cited in nearly 500 kernel CVEs. OpenAI says one October run of its research pipeline reproduced 1,724 kernel vulnerabilities. Noise remains: networking maintainer Jakub Kicinski estimated that a third to a half of the net-next patches in the 7.3 cycle appeared to be low-priority AI-driven fixes or cleanups.

Why was the Linux 7.4-rc2 diffstat so large?

Most of the bulk came from automated Coccinelle updates that Linus received during the merge window and held back for rc2 because he was traveling. They are mostly one- and two-line changes spread across thousands of files. With that noise masked out, roughly a third of the changes are drivers, a third are networking and BPF, and a third are everything else.

When will Linux 7.4 be released?

Linus has not announced a date. On the usual schedule, rc7 arrives on December 13 and the final release follows on December 20. An rc8 would move it to December 27. Linus says developers expect 7.4 to be the next long-term support kernel, though nothing is confirmed.

Does the Linux kernel accept AI-assisted patches?

Yes, under the same rules as any other patch. The submitter is responsible for the code and is expected to understand it, and an AI tool cannot sign off a patch on a developer’s behalf. The kernel dropped its Assisted-by disclosure tag in October, and Linus has rejected rules that ban the use of particular tools.

Is it safe to install Linux 7.4-rc2?

Only on a test machine or in a virtual machine. Release candidates are meant for testers, and regressions are still being found and fixed. If you want the fixes without the risk, wait for the final 7.4 release and the kernel updates your distribution ships.

Linux 7.4-rc2: Linus Torvalds Says the Tide on AI-Found Kernel Bugs May Be Turning