r/technology • u/ControlCAD • 8h ago
Security Linux kernel nears record 2,000 vulnerabilities per release as AI bug hunters scour 40 million lines of code — maintainers say they are "completely overwhelmed" by CVE finds
https://www.tomshardware.com/software/linux/linux-kernel-nears-2-000-cves-per-release-as-ai-bug-hunters-scour-40-million-lines-of-code-maintainers-say-they-are-completely-overwhelmed181
u/Big_District8152 7h ago
We also receive lots of AI generated pentest finding. 80% of them are plain bullshit and the people "create" them don't even read them. They just simply press send.
413
u/avatar_one 8h ago
Well, that's what you get when you have an open source code, which is actually good, as they will eventually get fixed :)
I dare not to think how many would have been found if Windows source code was open :D
129
u/baldycoot 8h ago edited 8h ago
lol probably need a black hole to power the compute required to fix an O/S windows.
18
u/Chronic_In_somnia 8h ago
If they open the source code we’d all see a moment like in the matrix when the cat walks by and Neo has déjà vu. Reality would lag.
5
1
u/Loa_Sandal 5h ago
Reminds me of some old video where they bypassed the Windows login by somehow printing the login prompt. Can't seem to find the video now though, but it was weird.
1
u/ar34m4n314 4h ago
I mean they are trying. Microsoft is part of project glasswing (Claude Mythos access), and they purchased a nuclear reactor to power datacenters (though technically for other stuff).
0
32
u/tralltonetroll 7h ago
Of course there are tons of such issues found. Microsoft also runs AI engines on their own code even if the code is not open.
And unless they are nuts, they also ask the AI engines for help to prioritize.
11
u/WealthyMarmot 4h ago
Microsoft is a core member of Project Glasswing, which is Anthropic’s invite-only program to grant unrestricted access to Mythos for defensive purposes, and you can bet they’re also part of the OpenAI equivalent.
1
5
7
u/emanuele232 7h ago
I agree, i do expect 0 days for closed source software to increase at a similar rate, and there you could have a lot of problems
3
u/Etiennera 7h ago
Afaik right now LLMs aren't trained on much machine code yet but there will come a day when an LLM can decompile and translate machine code, then a lot will change. At least at first it will be fairly resource intensive and not too hard to lock down.
5
u/Iggyhopper 6h ago
I do RE (revese engineering) and depending on the prompt, LLMs will give you injection code and help optimize assembly. (I needed the space so instead of wiping 300 bytes, I optimized it by half to make space for jumps.)
3
u/OrphisFlo 6h ago
They can already reason pretty well around machine code, or use assistance from a decompiler to quickly make sense of code.
They are not able to analyze fully a well obfuscated binary, but they can go pretty far otherwise, which is relevant for Windows. And it's not necessarily a token black hole that will cost millions per binary. Since a lot of Windows parts are already documented, it's easy enough to analyze anything from there.
2
u/No-Snow-7618 7h ago
would still be “lossey”
compiler optimization is some magical gremlin shit sometimes
3
u/Etiennera 7h ago
You would not necessarily get the original, but you'd get something that produces the same bytecode, which is good enough for most applications you'd want it for.
1
2
u/Ilikeyounott 8h ago
Do LLMs care if the source code is open or not? Like sure, seeing the source code is ideal and easier, but couldn't they just analyze the machine code? Or use a decompiler to turn it into ie. mangled c code that is a mess for human to make sense, but not so for LLMs?
22
u/electricity_is_life 7h ago
LLMs are powerful, but they aren't magic. They can certainly analyze binaries and decompilations, but the number and quality of findings will be lower compared to real source code.
1
u/Legionof1 7h ago
They don’t care… they can read source or binary and as long as they are trained on it they can read it. They can even decompile it into source again. How well they do it is another question entirely.
6
u/avatar_one 7h ago
I believe that no LLM could (at least for now) reverse engineer the closed source Windows code that is compiled and shipped.
2
u/OrphisFlo 6h ago
It depends which parts. From experience, they are doing fine, especially since a lot of the high level surfaces are documented, you are rarely fully in the dark.
3
u/slightly_drifting 7h ago
They are obfuscating and stripping symbols and shit. Def not gonna happen until they get trained on source leaks.
3
u/Ilikeyounott 6h ago
I threw winnat.sys at Claude, and it had no problem reverse engineering it using ghidra, and telling me how it worked. Sure, when it tells me where stuff happens, it's in opaque things like FUN_18001b110 since no debugging symbols, but it has no problem understanding the decompiled code (but it seems to be slower, I guess it has to work for it).
1
u/ARTIFICIAL_ARGUMENT 7h ago
Yea Microsoft would collapse overnight, having huge market share dependent on their closed source software is almost all their value
2
u/WealthyMarmot 4h ago
eh the software itself is not their core offering. It’a all the hosted infrastructure and the MSP ecosystem and the million other ways they’re tightly coupled into enterprise IT systems. We’re a long way from the Windows 95 days, when their product really was mostly just the set of floppy disks that installed the OS.
2
u/amakai 7h ago
Think of code as additional and very useful metadata on what's going on, sort of "comments" on what the code is supposed to be doing.
Consider this example. AI sees that a routine is opening a file and writing a fixed number into it. That looks like garbage without context. With context, that could be some integration with an external tool, but for that you ideally need docs, but source code naming also helps.
2
u/MartinMystikJonas 7h ago
Compiled code lacks tons of important context. You can see what is executed but in most cases you need additional info to know it it is executed as intended or not.
-2
u/Legionof1 7h ago
That’s a human outlook because we can’t hold the entire application in our brain at once. AI can potentially fly past that barrier because it can wholisticly understand the application from its source.
2
u/MartinMystikJonas 7h ago
No it cannot. LLMs have limited context windows. No chance to squeze even small part of OS source code there. And building of understanding of something as complex as OS from source code alone is way beyond capabilities of current frontier models. Not to mention that even tbat would not be enough to be sure what was original intent of that code.
-1
u/Legionof1 6h ago
The Linux kernel is roughly 40m lines of code, there are context windows big enough for that… what you can buy and what exists are also two massively different things.
→ More replies (6)2
u/romario77 7h ago
LLMs are trained on source code, not on machine code, so yes, they do care and do better if they have source code.
They can potentially analyze the machine code as well - it's a tougher task though. This actually has to be done and it's not equivalent to analyzing code - there are bugs in compiler and some of the vulnerabilities are not actually in the source code but only appear under some circumstances when the code is compiled.
1
u/Senior-Albatross 7h ago
They haven't been trained on machine code. That's not what's available as training data.
Actually, if we were smart, we might really optimize some machine code and then train these things on it directly. That way we could get better optimized outcomes if no one is ever going to read the code anyway.
4
u/BastetFurry 7h ago
I had Claude dissect an old game to find out how the assets are organized and loaded, he went to town with Radare2 on those old DOS binaries and found out how stuff works.
Now i have a nice document and the next weekend i have some time i might start adding Vision A 5th Dimension Utopia, that subsidized by the Sparkassen and LBS adventure game in that swimming tower, to ScummVM with the reversed info i got there. Vision 1 and 2 seem to use the same engine, so that would add both games.
2
u/OrphisFlo 6h ago
I regularly point Claude at games to extract data out of them that is otherwise hardcoded in the binary or internal data files. It's always able to figure it out in the end.
People are really underestimating what they can do.
173
u/slightly_drifting 7h ago
I can back this up. Some of these AI "pentests" and AI "bypasses" are being presented as individual CVE's that are complete bullshit, or are because the system it was run on was simply misconfigured and there's no CVE required. So now i'm looking at a mountain of bullshit, that's covering small molehills of real shit.
Now I know how those Pokemon card graders feel.
18
u/pbrutsche 4h ago
Anthropic Mythos (the one that Anthropic said was too dangerous to release) has only a 30% true positive rate.
1
u/WealthyMarmot 4h ago
Look at the changelogs for any one of a thousand large OSS projects these days - full of real CVE fixes, many discovered via AI. Look at how often OpenAI researchers are credited in Apple’s recent security bulletins (which have been unusually frequent, because AI is finding so much shit). There’s no sweeping this under the rug.
There’s a real problem with noise-to-signal ratio, for sure, but any org that doesn’t use AI defensively is going to get run over by the black hats.
36
u/Zeausideal 7h ago
The sad thing is that they send out a lot of "vulnerabilities" searches using AI to claim rewards, which is making it harder to report serious problems.
5
u/ImUrFrand 1h ago
the bug hunters are not doing so because of good nature, they are specifically going for bug bounties, which is why there are so many reports recently.
some software maintainers have killed their bug bounty programs because of this.
they have also noted that 95% of the bug reports weren't valid.
tl:dr; it's people looking for easy money.
4
u/virtualadept 1h ago
How many of them are meaningfully exploitable (e.g., are they "You have to be on the box already, have root access, and if exploited it causes a lockup or reboot?")
How many of them don't make it into the binary because they get elided or optimized away by the compiler at build time?
How many of them are hallucinations from the LLM?
12
u/ConSaltAndPepper 6h ago
What do I need to do to become a maintainer. I'm not a software developer but I love to learn. I have years of experience in IT and Data engineering and architecture.
What's the best way for me to begin to be able to properly help?
6
u/Cantabulous_ 6h ago
And, what do we think all of the GenAI providers and hyperscalers use - could it be Linux? Perhaps they might have some resources to spare.
3
u/yaosio 53m ago
Here's a list of top organization contributors. Some big names are there. https://insights.linuxfoundation.org/project/korg/contributors?timeRange=past365days&start=2025-09-01&end=2026-09-01
12
u/captainstormy 7h ago
It's important to point out that AI can scan the Linux Kernel because it's open source. So finding bugs is something it can do and it's actually good. They can be prioritized and fixed that way.
That just can't happen with a closed source OS like Windows or Mac.
8
u/dislikes_redditors 7h ago
It does and has been happening with Windows and Mac
4
u/captainstormy 7h ago
Yes, you can still do pen tests. But you can't just scan and analyze the source code which is far more effective.
5
u/dislikes_redditors 5h ago
They have access to their own source, and access to the same AI models. They are doing their own analysis the same way that others are analyzing OSS
0
u/captainstormy 5h ago
Sure. But that all happens behind closed doors so we have no idea how many findings there are or how serious they are.
3
u/ar34m4n314 3h ago
Not knowing is very different from isn't happening. Microsoft is scrambling to keep up. They know a lot of their code has leaked and that their customers are often security sensitive, its a business issue for them. Not a big MS fan, but realistically they are probably working very hard at this because they have a financial incentive to.
2
u/WealthyMarmot 3h ago
Both companies publish fairly comprehensive security bulletins. They’re not going to say, “we ran X tool and found Y number of bugs,” but you can go through the CVEs and get a pretty good sense of what they’re finding.
5
u/CondiMesmer 5h ago
How many of them are actually real?
2
u/ar34m4n314 3h ago
A significant amount. Here is a writeup by the people who make Firefox: The zero-days are numbered
1
6
u/ea_man 6h ago
It's funny because someone thought that with AI doing computer stuff they could fire some people, it's the opposite.
It's the weak links in a production chain lesson.
→ More replies (2)
2
u/No-Invite-7826 1h ago
What percentage of those CVEs are even valid? I know for a fact a lot of them end up being hallucinated and wastes of time.
3
u/I_am_le_tired 6h ago
People in this thread who think it's mostly bullshit issues are missing what's happening.
I watched a 30mn interview with a Mozilla senior dev working with Mythos who said the number of critical bugs and zero days that Mythos was finding was crazy, and that their bug fix rate was multiplied by 20x while they rush to patch the worse vulnerabilities before models as powerful or more as Mythos become available to everyone (including hackers) in a few months.
The companies that won't use Mythos super quickly super extensively will become prey to a wave of hacking agents that is hard to comprehend.
The next few years will be rocky as shit
5
u/Upbeat-Statement2725 3h ago
No. Mozilla is an "ai-first" company with a major financial stake. Man will say anything when his salary is involved.
As an example. OpenAI and HuggingFace weren't even using standard tools from decades ago. There should have been a pager setup to alert anyone of the test bed accessed the internet. And it should have been blocked immediately. Nobody bothered. This is a great argument that AI breeds complacency.
We had static testing tools to perform these tests, and alerting tools when they go wrong, decades ago.
HuggingFace magically found their attack the same day they sent a price to Jensen Huang. Weird coincidence.
0
u/Limp_Classroom_2645 7h ago edited 7h ago
why not also use ai to organize and fix those vulns, at least have a rough patch for each vulnerability proposed by AI and let humans review and adapt the patches?
This is not a bad thing, this is actually a good thing. all those vulnerabilities detected by ai could be zero days being exploited today by hackers and governments, now those vulnerabilities are visible and can be acted upon.
22
u/_5er_ 7h ago
Making a report doesn't automatically make it a valid report. There are a lot of cases, where reportes don't even bother to check if LLM report actually makes sense.
Sending a report back to LLM, to validate it doesn't really work. LLM can help you a lot yeah, but a person still needs to decide if it's valid.
→ More replies (4)3
u/OrphisFlo 6h ago
You can use them to some degree, but it's always a cost / effort balancing act. You could have Mythos try to create a PoC for each of them to see if they're true exploitable ones, a bug or just an impossible edge case.
It would take a while, but it's probably fine, machines will just work while you watch YouTube, but the cost will be astronomical. So you can only use some light classification with a cheaper model, some will be a "definite yes", a lot will be a "maybe" because it's hard to prove a negative (that it's not exploitable), some will be a "probably no".
But are you confident enough in the tooling yet to blanket reject an issue without a human expert looking into it? Do you want to be responsible for a massive breach caused by ignoring a valid report?
7
u/Jmc_da_boss 7h ago
"Why not also make the process even more draining and annoying for the maintainers"
Do yall people hear yourselves?
→ More replies (1)1
u/Blando-Cartesian 6h ago
These people are not maintaining a minecraft mod or some irrelevant social media hellhole. What they do needs to work and changes that require everything else to be updated can’t happen.
-2
u/SweatyAd8914 7h ago
Because the maintainers of Linux are turbo OCD and would rather launch the nukes than change a single pointer in a kernel level script.
0
u/marmaviscount 7h ago
When everything is worked through we will see a much more secure system, this is really good news
20
u/mekkr_ 7h ago edited 7h ago
No, we’ll likely miss actually severe and impactful vulnerabilities because they’ve been drowned in a sea of “ummm, actually” vulnerabilities that are more code quality issues or extreme edge cases than anything that’s actually worth being concerned about.
I’ve been in cybersecurity for a decade and AI has just shifted the problem from discovery to triage. Like everything else it touches it creates slop that needs slop to fix it. The infinite slop circus continues.
-12
u/marmaviscount 7h ago
The ai is also great at triage, you're desperate to dismiss this brilliant development in technology and it's just silly
9
u/mekkr_ 7h ago
I work a bug bounty program for a global company as part of my duties. If you think AI is good at triage I’ve got a datacenter to sell you.
-3
u/grchelp2018 6h ago
then you've not engineered the system properly. We use ai for triage. We also know that a lot of people just aim their ai at us and tell it to find something. So we've got detailed instructions telling the agent exactly what we need for a bug report, what we need for our agent to be able to reproduce it etc etc. And then once the bug report lands, our agent does triage, spins up vms to try and reproduce it, asks clarifications etc before finally deciding whether to surface it to us. Its an engineered pipeline not just an agent operating naked but it works well.
-1
u/marmaviscount 5h ago
Sure, random Redditor knows what all the big companies who release peer reviewed science on the subject don't...
I'm sorry but the compulsive liars on this site just make it impossible for me to believe these sorts of empty claims that go against everything everyone who is verifiably in the industry is saying and what all the science points to - either you're awful at your job and don't understand what everyone else is doing to get such good results or you're one of the many people who will spin any story to try and be prove their 'side' right.
4
u/smith7018 7h ago
Selfishly, it also means that locked down devices based on some of these open systems will be easier to hack. I'm looking at the PS5, Switch 2, Android devices, iOS devices, etc.
3
u/doommaster 7h ago
The PS5 runs on FreeBSD (sure it's also getting linted, but way less intensive)
2
u/wrgrant 6h ago
Does it really? Not a console gamer, but we ran FreeBSD on some servers when I worked for a company ages ago. I liked it. Now that you have told me this I know its still running nearby on the console my wife and nephew play on. Thats kind of cool in a very nerdy way.
3
u/doommaster 6h ago
Yeah, because the freeBSD license allows them to not publish their modifications to the system, which makes it harder to exploit.
4
0
u/oscarolim 3h ago
Thats a joke right? There hasn’t been a single play station that hasn’t been exploited.
1
u/doommaster 3h ago
Of course not, but not having access to the hypervisor source code makes exploiting a lot more complicated
0
7h ago
[deleted]
1
u/marmaviscount 7h ago
They just fixed the most bugs ever, I get not reading the article but at least read the headline lol
1
u/questron64 34m ago
And how many of those are real? AI will confidently declare it found a vulnerability and write a full detailed report but it also tells me to glue cheese to pizza. They wire them up in these test harnesses so they can run code and that is better than the old hallucinations directly into your veins but it's still by no means fixed.
0
u/EdgiiLord 7h ago
I will laugh after this whole AI craze when people will realize most of these are hallucinated because most devs wouldn't understand what the AI outputed and how they left Linux with less hardware compatibility and more hallucinated AI "fixes".
1
u/That-Interaction-45 6h ago
We are in an era of increasing insecure software until we hit peak and come down the other side. I have been updating everything I can get my hands on.
1
u/uniquelyavailable 6h ago
I agree, and this situation will continue to worsen. I am dealing with this on a daily basis. Send help lol
1
u/ReidenLightman 4h ago
No worries. Just have the 2 million free volunteer contributors audit all the code and submit vulnerabilities. Right?... Right?
-1
u/brakeb 5h ago
"completely overwhelmed" = we've never lived in a time where people actually had the time to look at our code, and AI is kicking our asses and showing our code quality has been shit for decades
We finally have the "many 👀 make for more secure code" that people have preached for decades about open source that they wanted, and this is the result of that
0
u/brakeb 5h ago
and they absolutely need to kick older shit out of the production releases... if you still 'need' that ISA sound card, then you'll build it yourself.
1
u/WealthyMarmot 4h ago
Yep I think the end result is a bunch of crusty old hardware drivers get purged. It’ll be annoying for some people, but it’s a net positive.
-3
u/SweatyAd8914 7h ago
I’m more impressed how LLMs were able to find these gaps in the first place. Either we’ve known about these vulns, and were too lazy/overwhelmed, and/or LLMs genuinely found these gaps and nobody ever knew.
Either way, congrats to Linux for patching these sooner than later. Looking at you Windows/Mac
15
u/Pawtuckaway 7h ago
Or LLMs hallucinated a bunch of CVEs that don't exist. My work heavily uses LLMs for many things and every PR has about 10 comments from an LLM reviewer. 90% of those comments are irrelevant or just flat out wrong.
→ More replies (1)-2
u/SweatyAd8914 5h ago edited 5h ago
If you’re not using Claude, your team is irrelevant and false positives are to be expected. I work F100 with strict compliance standards and 80% of flagged CVEs are legit. Sounds like a skill issue.
I’ll also reiterate, you’re correct on small nits, but big issues flat out wrong. I additionally could care less what the other morons here think.
→ More replies (2)5
u/Wizzarkt 7h ago
I read an article somewhere saying that the bast majority of those "bugs" were not real or at least not reproduceable so some Linux mainteiners are super mad because they get flooded with junk.
0
-6
0
0
0
0
u/BriefCautious7063 4h ago
I don't care what the CVE's are, I care about how exploitable they may or may not be. If a CVE just does something small it's irrelevant, but if a big one comes out it's more important to mention what it does than "look how many there are". On a scale of " make text look a little funny and do nothing else" to "zero-day kernel level remote code execution actively being exploited", all of it can be called a CVE and it goes without saying that the nature and exploitability of the vulnerability matters. If an AI flags a buffer overflow by just pointing out the usage of "unsafe" C functions, but fails to validate there being any way to input arbitrary data into those functions due to other safeguards, there's not even a vulnerability to begin with and maintainers still have to manually check thousands of requests. All headlines like this do is advertise AI as being smart enough to find thousands of vulnerabilities, scrutinize millions of lines of code, and be better at it than the overwhelmed maintainers; it doesn't acknowledge how many severe vulnerabilities were found, how many were patched, whether they're overwhelmed by work or by spam, etc
1.4k
u/Humpaaa 8h ago
I don't care about the millions of AI found CVEs. The important line is: Maintainers are overwhelmed.
We need to realize how much of our everyday infrastructure is not adequately supported, and find ways to divert ressources to these positions.