The Linux Kernel Is Approaching 2,000 CVEs Per Release

Phoronix reports on Greg Kroah-Hartman’s recent slide from his upcoming talk in Paris at Kernel Recipes 2026 (September 21 to 23): With the proliferation of AI/LLM models analyzing the Linux kernel’s vast codebase, there has been a surge in the number of CVEs per kernel release. After typically being around 500 CVEs fixed per release, we are now approaching 2,000 CVEs fixed per release and perhaps will break that threshold for Linux 7.3… Fortunately, most often they end up being lower priority vulnerabilities and often within old/obscure driver code, so the impact is often minimal.