Linus Torvalds: AI Is Changing Linux Fast

Summary

• AI has increased Linux kernel development volume

  • Linus notes the Linux kernel release process has been stable for ~20 years, but over the last ~6 months there’s been a ~20% increase in commits for recent releases.
  • He attributes much of the uptick to AI coding tools becoming good enough to lower the barrier to writing patches.

• AI is lowering the “patch-writing” barrier, but not without side effects

  • The tooling reduces initial effort by doing a big chunk of the work, enabling more people to contribute patches.
  • However, AI also forces workflow changes, pushing contributors out of their comfort zones—creating social friction in communities.

• Kernel “RC4” announcement includes AI-focused security disclosure guidance

  • In the context of an RC release announcement, Linus references new security disclosure guidelines with a specific stance regarding AI-discovered issues.

• Love/hate stance on AI coding

  • Linus says he enjoys AI technically and finds it useful for generating code/quality improvements.
  • The core problem is social/process impact, not that AI is inherently bad.

• Security mailing list overload from AI-generated reports

  • A key pain point: when people discover issues with AI, they often first send them to the Linux kernel security mailing list.
  • This led to the list being overwhelmed by many duplicate/near-duplicate reports (“tens/hundreds”) coming from people using the same AI tooling.
  • The kernel community changed policy so that if an issue is found with AI, it should be treated as effectively public (because many other people likely found the same thing using AI).

• Race conditions for vulnerability fixing (“zero minutes” problem)

  • Linus contrasts the time it takes maintainers to respond vs. how fast security researchers and blogs can react.
  • He cites the difficulty of preparing patches fast enough after public disclosure—especially when vulnerabilities are disclosed before mitigations are available.
  • Example mentioned: Dirty COW / local privilege escalation, characterized as publicized before being fixed.

• Incentives drive instant disclosure, even when exploits are in open source

  • Linus explains that security issues previously might be disclosed to distributors with limited detail (“please upgrade” without fully describing the issue).
  • With AI, the “figuring it out” step becomes faster/automated, increasing the chance that blogs appear within hours.
  • He argues there’s a strong incentive to be the first to publish, because security disclosures attract attention.

• Open source process constraints: cannot realistically avoid the disclosure dynamics

  • Linus’s view: the situation is hard to change; vulnerabilities will happen frequently in large codebases (kernel described as tens of millions of lines).
  • Avoiding open source wouldn’t solve it either, because AI can still help find problems in closed source—possibly even worse, since AI can’t help fixes as much, but can still find issues.

• Critique of “bug finders” without patch delivery

  • A recurring complaint: companies may publicize AI-discovered bugs but don’t provide patches, despite the bug being in open-source code.
  • He suggests a better path would be using the attention to also supply fixes, benefiting both users and maintainers.

• Positive framing

  • Despite social/security pain points, Linus remains optimistic: AI helps find bugs that otherwise might remain undiscovered.
  • In his words, the “real problem” is the bugs we didn’t find, and AI improves coverage—though the community must adapt socially and procedurally.

Main speakers / sources

• Linus Torvalds
• Durk (Durk?—head of Verizon’s Open Source Program Office)