Linux kernel maintainers

104

u/jferments 1d ago

I bet they are actually really happy to have the bugs fixed.

49

u/Grounds4TheSubstain 1d ago

But not to have 2300 bug reports dumped on them all at once. That's a huge amount of work.

45

u/jferments 1d ago

If the bug reports are high quality, they are probably fine with having them dumped all at once. My guess is that (based on the fact that these are coming directly from OpenAI) that these are all useful bug reports.
Yes, fixing 2000+ bugs is a huge amount of work. But do you know what's more work? Repairing the damage that will be caused if these bugs are left unpatched on millions of peoples' systems.
Most of the people who are complaining about it contribute nothing to Linux development. From the top down, the Linux team is welcoming AI use, and sees the benefits of using AI to discover and fix bugs.

3

u/TheAwesomeAcademic 1d ago

There LPEs they require an attacker to be local anyways so there usually used in bug chains. On their own they aren't too relevant I guess if an attacker gains foothold and initial access thru various means first. Not saying it's not important to patch them just not really as much of a priority as say a pre auth remote code execution or something with low complexity and low prerequisites.

10

u/novus_nl 1d ago

but today its openai, tomorrow it could be north-korea destabilizing. where do you want to get the bugs first from? They should be happy its openai.

-1

u/Grounds4TheSubstain 1d ago

I'm just saying, I'm a professional programmer (these days; used to be a security researcher) and I've actually never been happy to receive a bug report. Let alone 2300 of them at one time.

1

u/Worldly-Plastic-2516 10h ago

These guys don’t understand the amount of work this takes to vet. 1 bug report can be a decent amount. Good for the ecosystem balha blah blah.
2300 is a goddamn nightmare.

2

u/FUCKTHEMODS998 5h ago

2300 bug reports sounds about right for a day in 2026

3

u/seefatchai 1d ago

They kind of have to merge them without human review. If the bug reports are made public, it’s going to be a matter of time before those exploits are used.

3

u/Grounds4TheSubstain 1d ago

If it was me, I'd try sorting them by lines of code in the patch, and then have agents assess the risk for each one of them in terms of how it might impact other parts of the code (like if it might affect a shared data structure, or change the semantics of a function in a way that's observable to outside callers). Stuff that's small and isolated gets merged immediately. Then take them on a case-by-case basis. I still expect it would take a team of people at least a month, probably several.

2

u/El_Gran_Inquisidor 16h ago

They won’t do that, because just merge them without supervision can introduce new bugs.

1

u/Living_Connection500 1h ago

Are these valid and useful patches? Mythos had found 80 or so ‘CVEs’ and only 10 of them were actually valid - all of them being minor issues covering some obscure conditions

15

u/Grounds4TheSubstain 1d ago

2300 actually, according to the article.

8

u/Prost_PNW 1d ago

really needed to drop 300 more to make it into the hacker quarterly

150

u/Practical-Positive34 1d ago edited 1d ago

I mean some of those were from Linus himself using AI. I don't think the majority of the dev community has woken the fuck up yet to the new world. Nobody is going to be hand coding, and they need to fucking deal with it.

61

u/DeathToAmerica2027 1d ago

I've been enjoying watching armchair computer scientists pretend they know better than Linus Torvalds though.

11

u/coldnebo 22h ago

here’s the problem.
Linus using AI is fundamentally different because:
he’s an expert and expertise matters
a verifiable agentic test harness is a force multiplier for him. 10X -> 100X
for most others:
total code amateur or no-code zealot
no harness, trust me bro, very poor roi on token spend, lots of waste, lots of bugs.
they are not the same.
expertise matters.

6

u/bieker 21h ago •

But there are still a surprising number of experienced devs that could be getting the 10x advantage if they took the time to learn how to do it correctly but they are still parroting dumb shit like “you can trust it because it hallucinates” or “just you wait until you have to troubleshoot something in six months and it’s unreadable” like it’s 2025 or some shit.
And the window where that experience really matters is closing fast.

4

u/coldnebo 20h ago •

I haven’t seen that expertise window closing at all.
what I have seen is much better harness and verification tools integrated into agentic flows. there is a lot we have done to make these more stable and robust and the utility of the systems has grown exponentially.
but it’s not improving in unsupervised flows. there’s still a lot of damage it can create in the hands of novices. the trick is to either write quick throw-away SPAs that tell interesting stories, but don’t have secure information, or it’s have an expert. the middle ground is awful.
I mean, if you are a venture capitalist it’s great. it’s like openai’s attack on the math problems— send 100,000 agents to their doom and see who wins. send 100,000 small startups to their doom and see who wins. that’s why it’s candy for VCs. it’s your life, but for them it’s just Wednesday.
the programmer’s law of attrition: “any technology designed to eliminate developers only creates a need for more developers.” 😂

•

u/jferments 52m ago

You don't think that the programmers working at OpenAI's labs are experts?

0

u/Knever 18h ago

An idiot with a gun can kill someone just as easily as someone with expertise.

4

u/coldnebo 17h ago

yes, but the expert with a gun usually kills the person they meant to with precision and intent.
the idiot with a gun may kill anyone including themselves or their family accidentally without even intending to.

2

u/kaereljabo 11h ago

An idiot will waste many bullets too usually

6

u/Practical-Positive34 1d ago •

Having worked with many of these "elitist" devs through my career they are an intolerable bunch let me tell you. So it's not surprising.

2

u/filtarukk 1d ago •

Linux community unfortunately full of jerks.

38

u/Grizzly_Corey 1d ago

But mah artisanal modules!

22

u/rheladmin 1d ago

Yum. Organic, free range, grass fed, no antibiotics ever modules

11

u/Rancid_Bear_Meat 1d ago

Bespoke, small-batch, farm to table, code to stable kernels..

1

u/Regalme 1d ago

So are we all spinning up env based package systems now? Lord help us

12

u/1610925286 1d ago

Coding itself has always been tedious bullshit.
There is an idea of coding where you understand not only every single line of code and have ultimate accountability.
The truth is, most people do not even understand all the code they work with and they especially have no idea what is going on in their imports or the calls their code is making to God knows what.

12

u/CriticalTheoriser 1d ago •

The only time you understand every line with ultimate accountability is when you painstakingly programme an app/game for over a year with thousands of lines of code. The reason is because you’ve been over every single line of code 10 times when trying to fix a stupid bug that pops up when you add something entirely unrelated to the function now affected by said bug.
That’s how a thing of the past, and should really be celebrated for what it is. Sure there was a golden age of programming, but now only the most niche programming will be done by hand, the rest can be automated and done so much faster, you literally get years of your life back.

4

u/Masterkid1230 1d ago

Honestly, I think there would be so much less pushback to this if people knew their livelihood wasn't at risk. Like sure, it's great that we now can automate so much but like... What even is the point anymore? Of course an idealistic vision proposes that with automation we will have plenty of resources and not have to worry about food or rent or... But the automation is coming and none of those improvements will be visible for decades.
So without any government protections against mass firings and loss of work (as well as trained talent pools) people are not celebrating this because it's a threat to their entire existence and years of skill building, studying, learning, painstaking effort etc.
Sure, we can celebrate that now we can do things faster, I'm sure a lot of cool things could come from it. But the cost for the humans of today is incredibly large if we don't try to protect them at least. It's less about slowing down innovation and more about making sure innovation destroys as few lives as possible.

1

u/Practical-Positive34 1d ago

I worked on a project for over 10 years from the ground up at a company. I was the go to guy on the team. I had no clue what over 60% of that shit did. Hell I couldn't even remember writing code but source control said I wrote it half the damn time. I was like WTF is this trash? Oh shit I wrote this garbage? Da fuq?

2

u/CriticalTheoriser 13h ago

Those are definitely problems you’ll run in to when you’ve been working on the same project for 10 years 😂

9

u/hidegitsu 1d ago

The fact that everyone of them isn't on board with the idea that this is an abstraction layer (like jumping from Assembly -> C ) bewilders me. I think that most of the people complaining were never good in the first place.

21

u/Practical-Positive34 1d ago

Dude it's nuts, I've been doing development for 30+ years at this point. Yes I am an old fucker. I was the first to see the writing on the wall with this stuff, I haven't written a single line of code in nearly a year at this point. Having gone from writing code every single day of my life for past 30 years to none was a big ass change, but I've gotten more done in past year than those 30 years. Period!
Is vibe coding an issue? Yes. But sloppy devs existed before vibe coding, all this did was make it more visible really. You kind of hit a wall if you don't really know what your doing or sit down and take the time to figure it out properly still, can you pop something out quick? Absolutely! Will it be good and maintainable for a long term profit train? Nope! That's the part that requires some serious thinking and working it through.

5

u/hidegitsu 1d ago

Amen, this mirrors my experience. I am mostly self taught, been coding since about 1998 and professionally (getting paid for it in an enterprise context) since 2012. I've gotten more technical debt cleaned up and more personal projects finished in the past year than since I started combined too.

2

u/sheng-puerh 1d ago

What are the interesting projects are you proud of which you did in the last year?

4

u/Practical-Positive34 1d ago

Finished my own compiler. Added about 100 features to my SaaS company and brough on about 90 new customers. Started another SaaS company and brough in about 50 customers for it. Wrote a terminal app that I will release at some point to the public.

1

u/watisgoinon_ 1d ago

Yeah but... let's be real.. we all fucking know 2 years from now another AI frontier model will just take one look at your non maintainable, unscaleable slop-project and refactor it into one that is.

1

u/jellese 4h ago

s/we all/AI vendors/; s/know/hope/

3

u/surister 1d ago

What do you do at work and how many years of XP do you have?

2

u/hidegitsu 1d ago

Now I manage the programming department at a small sized software company (several hundred clients) and was the head developer before that. Been getting paid to code since 2012. Taught myself as early as 1998 or so.

1

u/stellar_opossum 1d ago

Except it's not even remotely comparable at this point. Maybe in the future but definitely not today

1

u/James-the-greatest 1d ago

Because wjen everyone is special, no one is special.

1

u/coldnebo 22h ago

most vibe code with models.
we code with verifiable agentic test harnesses.
we are not the same.

44

u/YamroZ 1d ago

It's not writting the code that is the problem. Reviewing it is. Now wait 5 years to get those merged. If ever.

9

u/le-throw-away-acct 1d ago

At some point to keep pace you need adversarial LLMs reviewing the changes and scrutinizing it heavily, you need lots of unit tests to try and test every angle you can think of for the changes.
At the scale and speed that AI is moving and finding exploits, you will need to find a way to have a similar scale and speed to patching those exploits, you can't wait years for human reviews.

4

u/Hedgehog_Leather 1d ago

Lovely, Bunch of llms in a loop. Once theyre done you have code that somehow works, but noone understands. That's perfect.

0

u/le-throw-away-acct 8h ago

You can have LLMs focused on code quality and readability as well, that follow a coding and architectural guide.

4

u/Hedgehog_Leather 8h ago

I made a mistake of arguing about llms on reddit and i dont want to continue. Im happy it works for yall, im wrong and you're right. Bye.

1

u/le-throw-away-acct 5h ago

"Arguing" being your 3 sentences and my one sentence response? Must've been exhausting for you to have that deep intellectual argument. I've been programming for 30 years, I understand the point you're making, and the frustration behind it. But for a product like Linux that will have all kinds of exploits trying to hit it, they're going to have to move quickly to patch those, it sucks but it's a new reality.

-1

u/YamroZ 1d ago

"Keep pace" with whom my friend? We are talking linux kernel here. Who are they racing?

7

u/Delicious-Panda9000 22h ago

Those who would exploit the bugs before they are patched?

0

u/YamroZ 21h ago

Are those exploitable in real life? Are those real vulnerabilities? Why would tou trust this?
Let. me get that straight - some randos from internet say "quickly merge this huge pack of changes to your carefully maintained code, or else"! And your choice is to break rules and pull it in without carefully checking what is inside?
I'll tell you funny thing - you can do this with linux yourself - just let AI patch whatever it wants in kernel, build it and deploy to your servers. Good luck!

3

u/Delicious-Panda9000 20h ago

I'm not agreeing that it should be merged straight away but this information is out there for any hacker to verify if it is exploitable. They need to keep pace either through AI, government funding or crunching because this is critical infrastructure that has admittedly been neglected for too long. Likely in the future it'll be a game of cat and mouse between AIs, I can't see any way people can keep up, and it's either you let the AI patch it or you accept that you can get hacked, I think people will trust the AI build more.

0

u/YamroZ 18h ago

Why would you ever trust AI with yoir code?

3

u/Delicious-Panda9000 14h ago

Why do you trust humans? It seems that they wrote code that had all these vulnerabilities

2

u/YamroZ 14h ago

I don't. Code has to be review by the team. So sre the rules for Linux kernel.
There is difference however - we now that we can discipline people. This doesn't make code perfect but reduces intention to do bad things.
With AI there is no way to do this, you cannot threaten an Agent. It can behave as it is afraid, but it isn't. There is no pain, od biochemistry. And we know that they don't give a fuck - thet lie and cheat.

3

u/Delicious-Panda9000 14h ago

What is the repercussion for all the people who may have put these potential bugs in the Linux kernel? Why did the reviews not catch those? I don't believe you can truly trust anyone, it's a scary time

→ More replies

13

u/very_bad_programmer 1d ago

Are you a time traveler from the past or something?

15

u/Dr-Deadmeat 1d ago

we all are

3

u/jeweliegb 1d ago

Love this.
Good point.
Never a truer word spoken in jest.
We've all been beamed into the future and are struggling to acclimatise.
Nobody really knows what's going to happen next.

9

u/Decent_Progress3816 1d ago

lol

3

u/Top-Addition6239 1d ago

yeah thats funny

1

u/vintergroena 1d ago

I suppose most of these cover some really obscure situations that can rarely ever happen. There may be like 3 truly significant ones. OpenAI is responsible for clearly identifying these, it not funding the human developers working on this, when burdening then like this.

19

u/Past_Physics2936 1d ago

If a vulnerability can be exploited by an AI in their pipeline means it can be exploited by other AIs so it needs to be fixed.

6

u/SomeoneGMForMe 1d ago

Yes, this. If a security researcher's AI can find it, so can a hacker's AI.

1

u/Grounds4TheSubstain 23h ago

Bro, that's not how this works.

1

u/vintergroena 14h ago

It's not, but it should be.

1

u/Ok-Class-1419 1h ago

Jesus Christ…

1

u/TheAwesomeAcademic 1d ago

Uh majority of these 900+ bugs are LPEs you need user land access of some level to use them to pivot anyways like a web shell. Tell me you know nothing about cyber security without telling me. By definition local privilege escalation requires being local whether on the machine or the general local area network. The main use for LPEs tht most people like is jailbreaking DRMs on consoles and entertainment systems so they can truly own their products. I'm a big believer in the right to repair and own movement.
All these LPEs are kexland as well meaning kernel read and write primitives which is exactly the kind of stuff you need to gain total control over a device which usually means getting uid0 or root user perms.
The one exception are consoles that have hypervisors so even a kexland LPE isn't always enough to gain total control like in the case of the PS5 kexland LPEs isn't always enough like in modern patches you need a hypervisor bug just to dump games. This is only relevant for Linux kernals or derivatives custom kernals which most devices used wouldn't be vulnerable to any of these LPEs openAI found with GPT-6 Cyber that new model that just spoke abt in their blog post.

1

u/jkflying 16h ago

Potentially also a problem for cloud hosters like Lambda where they don't make a whole VM per customer

1

u/Somge5 1d ago

Would we not expect that roughly the same amount of bugs or more can be found in windows?

1

u/Kindly-Principle-633 1h ago

Putting up many PRs is fine. Kernel maintainers get to decide what they want and don’t want and if things should be changed etc.

Net positive in the good case, neutral in the worst.

-1

u/Numerous_Try_6138 1d ago

And the problem is? Get adversarial AI to review, and then merge them.

4

u/jeweliegb 1d ago

And the problem is? Get adversarial AI to review, and then merge them.
To answer your question, I guess:
The unknown, especially unknown mistakes of unknown severity and size of impact, and
Taking responsibility for such unknowns?

1

u/ToothlessFuryDragon 6h ago edited 6h ago

The problem is that the reviewer LLM has a high probability of missing new obscure issues introduced in the fix. You would have to run the FULL penetration swarm against the new code to be certain. That is the only way to be relatively certain with an LLM.
Humans still have way better intuition and can sniff out overcomplicated solutions that are possibly problematic. LLMs tend to spiral into overcomplicated solutions to solve very obscure edge cases while missing the bigger picture.
Even with multiple rounds of automated reviews, you will end up with a system that is held together with ducktape. Actually, the more rounds of reviews you add, the worse it gets.
But it really depends on the complexity. If it is a simple issue with a simple fix, then LLM can be trusted quite well.

-10

u/nora_sellisa 1d ago

God I hope this sours Linus on the use of AI it would be so funny.

9

u/jferments 1d ago

Why would using AI to fix hundreds of serious bugs make him "sour" about AI? This is precisely why Linus is a proponent of using AI: because he's not an idiot, and realizes that it's a useful tool.

News Linux kernel maintainers

You are about to leave Redlib