Linus Torvalds shipped the seventh release candidate for Linux 7.2 on Sunday and made a point of saying he was not "exactly thrilled about the size of this all." By rc7 a kernel cycle is supposed to be winding down. This one took in more than 400 fixes signed off by over 230 people. Torvalds put the cause plainly: it is the new normal, and a lot of those fixes came out of review by AI tools.
One of them is worth sitting with. A use-after-free in ptdump, the interface that dumps the kernel's page tables as text, had been in the tree since Linux 4.16 shipped in March 2018. Syzbot hammered it out with malformed input. David Carlier wrote the first patch with an AI assistant helping trace the path, and memory management maintainer Lorenzo Stoakes reworked it before it landed.
Eight years, in the most heavily reviewed codebase on the planet.
Nobody let the robots write the kernel
This story got misread almost immediately. Torvalds is not saying AI is writing Linux. He is talking about tools that read existing code and flag things that look wrong. Humans still sort the pile, and the disclosure rules the project adopted last year still hold: if you used AI, say so, understand what you sent, and own it.
Which is the part I keep coming back to. The bugs in that rc were not created by AI. They were already there, in shipped code, running on your servers and mine. What changed is that something finally had the patience to read every path.
If you have ever inherited a legacy service and quietly hoped nobody would look too closely at the error handling, this should make you a little uncomfortable. The code is not getting worse. Our excuse for not knowing is.
The bottleneck moved
Here is the uncomfortable half.
Torvalds has also complained that the kernel security mailing list became almost unmanageable under a flood of AI-generated bug reports, many of them duplicates. In July the kernel team published 432 CVEs in two days. And research covered by The Register last week found that left to run autonomously, AI fixes often fail to fully remediate the flaw they were pointed at.
So the picture is not "AI finds bugs, AI fixes bugs, everyone goes home early." It is more findings than any human queue was built to absorb, arriving at uneven quality, still needing someone who knows the subsystem to say what is real.
Detection got cheap. Judgement did not. Adopt review agents without changing how work gets triaged and you have not bought capacity. You have bought a bigger backlog.
What this looks like in a normal engineering team
Most of us are not maintaining a kernel. The mechanics still transfer.
Point a review agent at your oldest, least-loved service and you will get a long report. Some of it is noise, some is genuinely alarming, and you will not know which is which until somebody who knows that codebase reads it. Budget for that person's time before you run the scan.
Decide up front what happens to a finding and who owns triage. A finding with no owner is not a fix, it is a liability with a timestamp on it. If a breach report later shows you were told in March, "we were busy" reads badly.
Nothing merges unreviewed, however confident the diff looks. The kernel's answer is the right one here: a human name goes on the commit, and that human wears it.
Test coverage stops being optional too. Torvalds can absorb 400 late fixes because the kernel has decades of test infrastructure behind it. If your CI is three unit tests and a prayer, that same volume is a hazard rather than a gift.
The honest read
Linux 7.2 is expected to ship without delay. Torvalds looked at an unusually large rc, decided nothing in it was scary, and moved on. That is a project with enough process to handle a step change in how bugs surface.
Most teams do not have that. The tooling arrived faster than the habits did, and the gap between the two is where the next incident lives.
Worth asking your team this week: if we ran a serious review pass over our oldest service tomorrow, who reads the output, and what actually happens to it?
OrionX builds and maintains CI/CD pipelines and cloud infrastructure for Australian businesses. If AI review is surfacing more than your process can absorb, that is a pipeline problem before it is a tooling problem.
Sources
- Linus Torvalds says AI has made 'huge' Linux kernel updates the new normal, The Register, 10 August 2026
- Linux 7.2-rc7 Released Following Another Exhausting AI-Driven Week, Phoronix, 9 August 2026
- Linux 7.2: AI reviews kernel code and Torvalds finds the bill steep, Korben (ptdump use-after-free detail, patch attribution)
- Linux kernel team publishes 432 CVEs in two days, The Register, 22 July 2026
- AI struggles to patch vulns without adult supervision, The Register, 6 August 2026
