[Discuss] With AI, 2, 000 Vulnerabilities per Linux kernel release

[kentborg at borg.org (Kent Borg)]

On 9/4/26 5:16 AM, Rich Pieri wrote:
> There are a finite number of bugs in any given proposed kernel release.
> If tools find 2000 of them, and they are remediated, then there are
> 2000 fewer bugs in that release.

Yes, for the Linux kernel.

I've heard it argued that in some code bases there are an infinite 
number of bugs, and infinity minus 2000 is still infinity.

The logic is some code bases are so bad that changes to remove one bug 
churns the crap enough that is is impossible to say that the bug count 
went down.

In those cases the thing to do is throw it away. Maybe?put it in an 
isolation box to reduce attack surface and to reduce the blast radius 
until it can be thrown away.

Luckily the Linux kernel is not one of those cases.


-kb