Linus Torvalds backs AI-assisted coding and kernel code review, while warning of the maintainer burden from AI-generated patches and bug reports
At Open Source Summit Europe in Prague, Linus Torvalds told Dirk Hohndel (Ericsson Software Technology) that he likes using AI, particularly for beginners and for tasks outside his expertise. He cautioned that it must be used carefully in important work such as the Linux kernel. AI tools now help find and fix kernel bugs, including genuine security problems and issues in old, unused drivers. They also generate fabricated bug reports and "mindless band-aid" patches that strain maintainers. This is an industry and process discussion, not a security incident, and it names no vulnerabilities, threat actors or IOCs.
Technical Details
- Sashiko, an agentic Linux kernel code review system, now posts public reviews on the Linux Kernel Mailing List (LKML). Some subsystem maintainers require such a review before accepting patches.
- Torvalds said AI review is "improving our code base" but is "stressing maintainers out to the point that it's a problem."
- Fabricated but convincing AI bug reports take substantial human effort to disprove, and narrowly targeted patches may fix a symptom without addressing the root cause.
- Three-quarters of the preceding day's Linux Kernel Maintainer Summit discussion focused on making AI generation and review less stressful and more useful.
- Torvalds also reviewed Linux history: tarball patches, BitKeeper, the creation of Git in 2005, and the move to a 9-10 week release cycle.
Remediation
No remediation is applicable. The article recommends treating AI as a tool, using it carefully on important code, and managing the review load on maintainers.
Linha do tempo
-
Linus Torvalds backs AI-assisted coding and kernel code review, while warning of the maintainer burden from AI-generated patches and bug reports
ler a análise desta fonte ocultar
At Open Source Summit Europe in Prague, Linus Torvalds told Dirk Hohndel (Ericsson Software Technology) that he likes using AI, particularly for beginners and for tasks outside his expertise. He cautioned that it must be used carefully in important work such as the Linux kernel. AI tools now help find and fix kernel bugs, including genuine security problems and issues in old, unused drivers. They also generate fabricated bug reports and "mindless band-aid" patches that strain maintainers. This is an industry and process discussion, not a security incident, and it names no vulnerabilities, threat actors or IOCs.
Technical Details
- Sashiko, an agentic Linux kernel code review system, now posts public reviews on the Linux Kernel Mailing List (LKML). Some subsystem maintainers require such a review before accepting patches.
- Torvalds said AI review is "improving our code base" but is "stressing maintainers out to the point that it's a problem."
- Fabricated but convincing AI bug reports take substantial human effort to disprove, and narrowly targeted patches may fix a symptom without addressing the root cause.
- Three-quarters of the preceding day's Linux Kernel Maintainer Summit discussion focused on making AI generation and review less stressful and more useful.
- Torvalds also reviewed Linux history: tarball patches, BitKeeper, the creation of Git in 2005, and the move to a 9-10 week release cycle.
Remediation
No remediation is applicable. The article recommends treating AI as a tool, using it carefully on important code, and managing the review load on maintainers.