The Linux Kernel Is Approaching 2,000 CVEs Per Release

With the proliferation of AI/LLM models analyzing the Linux kernel's vast codebase, there has been a surge in the number of CVEs per kernel release. After typically being around 500 CVEs fixed per release, we are now approaching 2,000 CVEs fixed per release and perhaps will break that threshold for Linux 7.3.

Ahead of the Kernel Recipes 2026 event taking place 21 to 23 September in Paris, France, Greg Kroah-Hartman shared a teaser of his upcoming talk. He shared a slide showing the Linux kernel CVEs per release from the latest Linux 7.2 back through Linux 6.9. From Linux 6.9 through Linux 6.19 was averaging around 500 CVEs fixed per release while since Linux 7.0 it's been beyond one thousand per release. Another big step up with Linux 7.2 when breaching 1,500... If the generative AI keeps up, it's likely imminent surpassing two thousand CVEs per release.

With the Linux kernel source tree around 40 million lines, there remain many potential vulnerabilities for LLMs to discover. Fortunately, most often they end up being lower priority vulnerabilities and often within old/obscure driver code, so the impact is often minimal. Though with AI era and the superfluous bug/security reporting has also been a driving factor this year for clearing out lots of obsolete kernel code.