Linux's 2,000-CVE release is a labor story, not a security one

The Linux kernel is not getting less secure. It is getting more expensive to review.

When the headline number climbs from roughly 500 fixed vulnerabilities per release to a projected 2,000, the obvious read is a decay story: open source's most important codebase is breaking under AI pressure. The actual read is a labor story. AI tools now scan 40 million lines of kernel code and report faster than the small community of human maintainers can filter. Linux networking maintainer Jakub Kicinski put a name on it in the Linux 7.3 pull request: "We are completely overwhelmed." He estimated a third to half of the 648 networking patches in the cycle were low-priority fixes, cleanups, or outright hallucinations, the kind of noise a maintainer still has to read before rejecting.

When the cost of finding a flaw collapses, the bottleneck moves from finding to triaging. Anything that cannot be triaged by the available reviewers gets cut. Linux 7.3 is the first release where that math shows up as a named code deletion, not just a patch queue. Maintainer Andrew Lunn's April 2026 proposal to remove nearly 28,000 lines of legacy networking drivers is now shipping, alongside old SGI and IBM drivers. The kernel is shrinking to make room for the scanners.

That is the real signal inside the 2,000 number. It is not a measure of how broken the kernel is. It is a measure of how expensive AI has made reviewing it, and the price is being paid in code that nobody runs.