Linux Kernel Maintainer Steps Back From Review Duties as AI-Generated Patches Flood Inboxes — BigGo Finance

An Arm principal software engineer who helps oversee some of the Linux kernel’s most sensitive memory-management code is pulling back from general patch review, saying the volume of machine-generated submissions has made his inbox unmanageable.

Lorenzo Stoakes, who has contributed to the kernel since 2014 and holds maintainerships covering memory mapping, madvise and reverse mapping, announced the change in a mailing-list post this week. He said he will keep those maintainer roles but will no longer review code outside the areas he owns.

“Given the current throughput in the kernel resulting from AI-generated series, I unfortunately lack the bandwidth to generally be able to offer review except in those areas I maintain,” he wrote, adding that he wanted to make his inbox “a little more manageable.”

In remarks to The Register, Stoakes said he is not leaving kernel work and has no plans to give up his maintainerships. He described the shift in his review queue as moving from occasional junk to roughly half of everything he sees. “But the AI wave is hitting [memory management] across the board, really,” he said.

The episode has put a spotlight on a widening bottleneck in open-source development: finding bugs has become cheap, while judging and repairing them has not. Microsoft’s FORGE Lab said its MDASH scanning system recently produced 59 upstream Linux kernel bug reports, one of them describing a flaw at least 21 years old. That total is modest next to the broader flow. The Linux Common Vulnerabilities and Exposures team has been averaging about 27 CVEs a day in 2026 through Nov. 2, according to ZDNET.

The same pressure is visible well beyond Linux. In its most recent Patch Tuesday release, Microsoft disclosed 726 CVEs. A large share of such reports now originates with AI tooling, leaving human reviewers as the constraint.

Greg Kroah-Hartman, who maintains the kernel’s stable releases, raised the alarm at the Open Source Summit Europe. “The onslaught of the LLM-generated patches… we don’t have enough people to review them all,” he said. “We need more reviewers. We don’t have enough. All of the maintainers are burnt out, and we have been for ten years.”

Kroah-Hartman has also argued for shrinking the number of long-term support releases the project carries, saying six is too many and that the team lacks the manpower to sustain them. He has been critical of the decade-long support model that Red Hat and SUSE attach to specific kernel versions, pointing to Debian’s approach as the better template.

There are tentative signs of relief. Linus Torvalds wrote on the Linux Kernel Mailing List that much of the new code in the Linux 7.4 rc 2 release candidate “was driven by various AI fixes,” and that in the BPF subsystem fixes are now arriving faster than new reports. He called that “a sign that we may be starting to see the tide starting to turn,” while cautioning readers not to hold their breath.

Kroah-Hartman is less sanguine. Asked whether AI-assisted fixes are catching up with AI-generated reports, he said the project is “getting closer, yes, but not quite there yet,” and declined to estimate when that point might arrive.

Daniel Steinberg, creator of the open-source cURL project and a frequent critic of low-quality machine-generated bug reports, offered a more measured view. He said the project has so far managed the flood reasonably well, though the load rises and falls depending on which contributor sends a new batch of findings in a given week.

The stakes extend past maintainer fatigue. November alone brought a serious Linux TCP networking vulnerability, a damaging OpenSSH flaw in Alpine Linux, a near-miss at Alpine’s GitLab instance and the widely unpatched PHP2Shell issue.

For companies that build products on the kernel, the review crunch matters because it lengthens the gap between a reported flaw and a shipped fix, and because maintainers under strain are more likely to miss a subtle defect buried among low-value submissions. For the Linux Foundation and its corporate backers, the pressure points toward funding dedicated review capacity rather than more scanning tools.

Note: Figures are as reported by the companies and projects involved.