Administrators of Linux environments were confronted this week with an unusual number of new security reports. In just two days, 432 CVEs were published for the Linux kernel. The sheer volume of this influx is raising questions within the open-source community about the sustainability of the current process for reporting, assessing, and addressing vulnerabilities.
On the OSS-SEC mailing list, Jan Schaumann, Chief Information Security Architect at Akamai, sounded the alarm. According to him, it is no longer realistic for security teams to analyze every single kernel vulnerability and set priorities based on that analysis. The number of reports has simply become too large for that.
Schaumann notes that, in theory, organizations could use a large language model to automatically classify new CVEs. However, he believes this merely shifts the problem. As dozens of new reports continue to appear each day, the workload remains virtually unchanged.
Automation seems inevitable
Speaking to The Register, Schaumann cites extensive automation as ultimately the only realistic way to handle the growing flood of Linux vulnerabilities. At the same time, he points out that large organizations, in particular, often cannot simply implement fully automated updates because they are dependent on lengthy testing and release processes and contractual support obligations.
According to Schaumann, this effectively leaves two strategies: updating all Linux systems very regularly, or waiting to see which vulnerabilities are actually exploited and develop into serious risks. He believes both approaches have clear drawbacks.
AI increases the workload
There is speculation within the Linux community that the rapid increase is partly due to AI-assisted vulnerability research. Automated analysis makes it easier to systematically check large amounts of source code for errors, thereby uncovering more potential security issues.
This development aligns with earlier statements by Linux creator Linus Torvalds. In May, he stated that the Linux security mailing list has now become “virtually unmanageable” due to the large volume of AI-assisted bug reports.
At the same time, Torvalds is not opposed to the use of AI in kernel development. In fact, he views artificial intelligence as a valuable tool for developers. He does acknowledge, however, that AI significantly increases the workload for maintainers, as the technology continually discovers new bugs that must all be reviewed and addressed.
Not every CVE is a serious vulnerability
Incidentally, the large number of new CVEs does not mean that Linux is suddenly facing hundreds of critical security vulnerabilities. The Linux kernel project uses a broad definition of a vulnerability. Virtually any software error that could affect the confidentiality, integrity, or availability of a system qualifies for a CVE.
This policy ensures that even relatively minor or hard-to-exploit errors receive their own CVE number as soon as a bug fix is included in a stable kernel version. The result is a more comprehensive overview of security issues, but also an ever-increasing administrative and operational burden for organizations that must assess all reports.
The discussion illustrates a broader trend within cybersecurity. AI helps developers and researchers detect vulnerabilities more quickly. At the same time, it increases the pressure on security teams responsible for triage, risk assessment, and patch management. The challenge is thus shifting from finding vulnerabilities to efficiently processing the rapidly growing stream of reports.