On a Linux kernel mailing list this week, Lorenzo Stoakes, a long-serving engineer at Arm, quietly narrowed the reach of his own attention: he will now review code only within the memory-management territory he maintains. His reason is a familiar human limit meeting a new kind of abundance, since machines can now find flaws faster than people can judge and repair them. The episode sits within a wider reckoning across open-source software, where the cost of discovery has fallen while the labor of care has not, and where the people holding the commons together are being asked to carry more than
Linux Maintainer Pulls Back From Patch Review as AI-Generated Submissions Overwhelm Kernel Reviewers
Kernel maintainers are reported to be burnt out from sustained review overload, with reviewers stretched thin across growing volumes of machine-generated submissions.
Finding bugs has become cheap, while judging and repairing them has not.
Mark
Stoakes isn't quitting. So what actually changed?
Mimi
His scope. He keeps memory mapping, madvise and reverse mapping, but he won't review anything outside them. Before, he could help across the kernel.
Mark
He says about half his queue is now junk. How solid is that?
Luke
It's his own estimate, given to The Register. It's a credible firsthand account, but nobody has published a kernel-wide measure of how much of the review load is AI-generated.
Mimi
And it's specific to memory management, which he says is being hit across the board.
Mark
The numbers in the story are large: 27 CVEs a day, 726 in one Patch Tuesday.
Luke
Worth noting those are different things. The source says figures are as reported by the companies and projects involved, and it doesn't say how many of those CVEs are AI-originated, only that a large share of such reports now are.
Mark
Torvalds sounds hopeful, Kroah-Hartman doesn't.
Mimi
Torvalds points to BPF, where fixes now arrive faster than reports. Kroah-Hartman says closer but not there yet.
Luke
And neither gives a date. Torvalds himself says don't hold your breath. One subsystem isn't the whole kernel.
Mark
So what's the real problem?
Mimi
Reviewers. Finding bugs got cheap, judging and fixing them didn't, and Kroah-Hartman says maintainers have been burnt out for ten years.
Le Pouls
- An engineer who has contributed since 2014 is cutting back his review scope because AI-generated patches now make up roughly half of his queue.
- Stable-release maintainer Greg Kroah-Hartman warns that the people who keep the kernel safe are burnt out, and that finding bugs is cheap while fixing them is not.
- A flood of machine-found flaws, from a 21-year-old kernel bug to hundreds of CVEs a month, is landing on a small pool of human reviewers.
- Linus Torvalds reports BPF fixes outpacing new reports and sees the tide possibly turning, though he warns against holding one's breath.
- Kroah-Hartman says the project is getting closer but is not there yet, and the gap between a reported flaw and a shipped fix is still widening.
On a Linux kernel mailing list this week, Lorenzo Stoakes, a long-serving engineer at Arm, quietly narrowed the reach of his own attention: he will now review code only within the memory-management territory he maintains. His reason is a familiar human limit meeting a new kind of abundance, since machines can now find flaws faster than people can judge and repair them. The episode sits within a wider reckoning across open-source software, where the cost of discovery has fallen while the labor of care has not, and where the people holding the commons together are being asked to carry more than their hours allow.
This week, Lorenzo Stoakes, a principal engineer at Arm who has worked on the Linux kernel since 2014, posted a short notice on the kernel mailing list. From now on he will review only the code in the memory-management areas he maintains. The reason was simple: the volume of AI-generated patches had overwhelmed his inbox. What used to be an occasional piece of junk now makes up about half of what reaches him. He is not leaving the project and is keeping every maintainer role, but he can no longer read everything.
His situation reflects a bottleneck spreading across open-source development. Automated scanners are producing bug reports at a pace no team can match. Microsoft's FORGE Lab recently sent 59 upstream kernel reports, one describing a flaw at least 21 years old, and the Linux CVE team has averaged about 27 CVEs a day this year. Greg Kroah-Hartman, who maintains the stable releases, put it bluntly at the Open Source Summit Europe: there are not enough reviewers, and the maintainers have been burnt out for a decade.
There are small signs of relief. Linus Torvalds noted that much of the new code in the 7.4 release candidate came from AI-driven fixes, and that BPF fixes are now arriving faster than reports. Kroah-Hartman is more cautious: the gap is closing, but it has not closed, and he will not guess when it will. The stakes are real. November brought a serious TCP vulnerability, a damaging OpenSSH flaw, and a widely unpatched PHP issue, and every week of review backlog stretches the time between a found flaw and a shipped fix. What to watch next is whether the BPF pattern spreads to other subsystems.
This week, on a kernel mailing list, Lorenzo Stoakes posted a short notice that narrowed his role in the Linux project. Stoakes is a principal software engineer at Arm and has contributed to the kernel since 2014. He holds maintainerships covering memory mapping, madvise and reverse mapping. From now on, he said, he will review code only in the areas he owns.
His reason was volume. "Given the current throughput in the kernel resulting from AI-generated series, I unfortunately lack the bandwidth to generally be able to offer review except in those areas I maintain," he wrote. He said he wanted to make his inbox "a little more manageable."
Speaking to The Register, Stoakes was clear that he is not leaving. He is keeping his maintainer roles and has no plans to give them up. He described how his review queue has changed: it used to contain the occasional piece of junk, and now roughly half of what reaches him falls into that category. "But the AI wave is hitting [memory management] across the board, really," he said.
His decision points to a bottleneck that has been widening across open-source development. Finding bugs has become cheap, while judging and repairing them has not. Microsoft's FORGE Lab said its MDASH scanning system recently produced 59 upstream Linux kernel bug reports, one describing a flaw at least 21 years old. That is a modest number beside the wider flow. According to ZDNET, the Linux CVE team has averaged about 27 CVEs a day in 2026 through Nov. 2. Beyond Linux, Microsoft disclosed 726 CVEs in its latest Patch Tuesday release. A large share of such reports now originates with AI tooling, which leaves human reviewers as the constraint. These figures are as reported by the companies and projects involved.
Greg Kroah-Hartman, who maintains the kernel's stable releases, raised the alarm at the Open Source Summit Europe. "The onslaught of the LLM-generated patches... we don't have enough people to review them all," he said. "We need more reviewers. We don't have enough. All of the maintainers are burnt out, and we have been for ten years." He has also argued that the project carries too many long-term support releases, saying six is too many for the available manpower. He has criticized the decade-long support model that Red Hat and SUSE attach to specific kernel versions and pointed to Debian's approach as a better template.
There are tentative signs of relief. Linus Torvalds wrote on the Linux Kernel Mailing List that much of the new code in the Linux 7.4 rc 2 release candidate "was driven by various AI fixes," and that in the BPF subsystem fixes are now arriving faster than new reports. He called that "a sign that we may be starting to see the tide starting to turn," while cautioning readers not to hold their breath.
Kroah-Hartman is less hopeful. Asked whether AI-assisted fixes are catching up with AI-generated reports, he said the project is "getting closer, yes, but not quite there yet," and he would not estimate when that might happen. Daniel Steinberg, creator of the open-source cURL project and a frequent critic of low-quality machine-generated bug reports, took a more measured view. He said cURL has so far handled the flood reasonably well, though the load rises and falls depending on which contributor sends a new batch of findings in a given week.
The stakes reach past maintainer fatigue. November alone brought a serious Linux TCP networking vulnerability, a damaging OpenSSH flaw in Alpine Linux, a near-miss at Alpine's GitLab instance and the widely unpatched PHP2Shell issue. For companies building products on the kernel, the review crunch lengthens the gap between a reported flaw and a shipped fix, and strained maintainers are more likely to miss a subtle defect buried among low-value submissions. For the Linux Foundation and its corporate backers, the pressure points toward funding dedicated review capacity rather than more scanning tools. What to watch is whether the BPF pattern Torvalds described, fixes outpacing reports, shows up in other subsystems.
Citations marquantes
We need more reviewers. We don't have enough. All of the maintainers are burnt out, and we have been for ten years.— Greg Kroah-Hartman, Linux stable kernel maintainer
A sign that we may be starting to see the tide starting to turn.— Linus Torvalds, on BPF fixes outpacing new reports
Envie de l'histoire complète ?
Lire l'original sur BigGo Finance ↗