Recently, Microsoft’s FORGE Lab reported that its AI scanning system, MDASH, turned up 59 upstream Linux kernel bug reports, including one flaw at least 21 years old. That’s less impressive than it sounds. For 2026, through Nov. 2, the Linux Common Vulnerabilities and Exposures (CVEs) team reported an average of 27 CVEs a day.
Why so many? Easy: in Linux, any bug can be a security bug. As Linux Torvalds told me in 2024, “Bugs will happen, and anything can be a security bug if somebody is clever enough to just figure out how to abuse it.” Besides, since Linux runs everything from smartphones to refrigerators to supercomputers, what may be a serious bug in one device may not even appear at all on another.
It’s not just Linux, though. In the latest Windows Patch Tuesday security release, Microsoft reported 726 CVEs. The vast majority of these bug reports are coming from AI programmers. Finding bugs on anything is no longer the hard part. But reviewing and fixing them is, and both Microsoft developers and kernel maintainers are struggling to keep up.
Also: Microsoft fixes over 1,000 Windows flaws – and one is being exploited
That’s hurting the overworked maintainers. On Nov. 10, an ARM engineer and Linux kernel maintainer Lorenzo Stoakes gave up reviewing code.
