Video summary
Linus Torvalds: “We’re Going in the Wrong Direction”
Main summary
Key takeaways
Overview
Linus Torvalds argues that Linux kernel development is “going in the wrong direction,” mainly because:
- The volume of merge requests has become overwhelming.
- AI-assisted patches don’t always meet quality or prioritization expectations—especially when submitted late in the release cycle.
He also claims the kernel’s merge windows have become too chaotic, producing excessive risk—even though tooling helps detect vulnerabilities.
Key Points and Evidence
1) The merge process is strained and riskier late in release cycles
Torvalds believes maintainers are increasingly submitting last-minute fixes that can introduce new problems.
He emphasizes a strategy of postponing non-critical fixes to the next release because kernel releases happen frequently (about a ~9-week window).
He also suggests his more aggressive stance—rejecting more merge requests—is an attempt to correct course after “very big” releases left him worried.
2) AI finds issues faster, but increases low-quality throughput
AI-powered tooling can detect vulnerabilities more quickly, which encourages more submissions.
However, Torvalds notes that some AI-generated patches are low priority or low quality, adding to workload and potentially increasing security/maintenance risk.
3) Rising vulnerability counts signal serious security impact
The number of reported CVEs per kernel release has risen sharply:
- About ~500 early on
- Stable through 6.9–6.19
- Then jumping 6.19 → 7 → 7.2
- Reaching nearly 2,000 CVEs per release
This is presented as a major security concern, particularly for kernel and networking security maintainers.
4) Networking merge workload surges; maintainers feel overwhelmed
Following AI uptake, maintainers merged hundreds of networking-related patches—around:
- ~632
- plus 648 additional
Torvalds reports that up to half may be low-priority AI-generated fixes.
A maintainer (Jacob) is quoted saying:
“We are completely overwhelmed.”
5) Torvalds’ role is trust-based reviewing, not deep code reading
Although he is a merge authority, Torvalds says he hardly ever reads code anymore.
Instead, he relies on:
- Trust in specific maintainers he has worked with for years/decades
- Strong pull-request explanations (which he reads for the overall picture)
- Code review primarily when necessary, such as:
- merge conflicts
- unclear explanations
- overlapping or conflicting changes
He argues open source has historically depended on trust in people, not tools—and that this persists even as developers change companies.
Personal Stress Drivers
Torvalds says merge-window stress comes mainly from interpersonal issues, not technical difficulty.
He also mentions that merge-window work is inconvenient (even while traveling), but he does not frame the raw workload itself as uniquely nerve-wracking.
Tooling Philosophy
He describes his approach as:
- Git and email as primary tools
- Google to search unfamiliar acronyms/topics
He notes that other maintainers may use additional tools (including AI patch-checking), but for his workflow the emphasis is on trust and communication, not heavy tooling.
Overall Argument
AI and automation can improve vulnerability discovery, but they also:
- Accelerate patch volume
- Potentially degrade review quality and prioritization
- Increase security exposure and operational overload
Torvalds concludes that the workflow must change: developers should provide better explanations and avoid flooding late release cycles with fixes that carry avoidable risk.
Presenters / Contributors
- Linus Torvalds (speaker)
- Dirk — head of the open source office at Verizon
- Jacob — maintainer quoted: “We are completely overwhelmed.”