r/linux • • 2d ago

Kernel Linux Networking Diverts 50+ Fixes To Next Kernel, Still Bombarded With AI Fueled Churn

https://www.phoronix.com/news/Linux-7.3-rc7-Networking
304 Upvotes

75 comments sorted by

78

u/death_by_cormorant 1d ago

Strangely negative way to frame this. I'm personally glad bugs are being found and fixed.

And for anybody thinking it's wrong for them to use AI to find bugs, I understand your frustration at AI, but what's your alternative?

If they put ideology ahead of practicality by refusing to bug hunt with AI tools, bad actors will still do it. They'll take advantage of that.

35

u/Fmatias 1d ago

The issue is the responsible use of it. If done correctly, AI can be a very good tool for finding bugs but unfortunately, as with most AI things, it is abused.
Several open source projects stopped accepting AI bug reports because of the amount of low error false reports. People get AI to find bugs and don’t validate anything before submitting. As a result, many projects are flooded with reports that they have to go trough( most of them hallucinations ), validate and close which puts a big load on those teams.

1

u/ottovonbizmarkie 4h ago

I had someone who maintained a fairly popular open source project tell me that basically people are just creating PRs on every Open Source Project under the sun whenever a CVE comes out, which may have nothing to do with the project itself. They are clout chasing so they can brag about how they fixed a CVE or something (or they are a state entity doing social engineering).

14

u/ABotelho23 1d ago

Greg Kroah-Hartman had a presentation a few months ago about this.

It's not that they're finding all these bugs. It's that the LLMs are designed to make you "happy" and the bugs being filled are junk the vast majority of the time. There's a lot of useless crap being thrown their way and they have to sift through it.

-2

u/mrlinkwii 19h ago

the bugs being filled are junk the vast majority of the time. There's a lot of useless crap being thrown their way and they have to sift through it.

isnt this like most bug reports , while i agree their is a higher percentage of junk bugs , they existsed before AI

4

u/KnowZeroX 15h ago

Many junk bugs before are simply due to user misunderstanding, but AI junk bugs is often times because the person submitting the bug has no clue to begin with and never even bothered to test it themselves.

So you went from maybe hundreds of thousands of people max who could submit a bug to a billion people.

6

u/The_Real_Random_User 16h ago

The presentation in question: (properly)

Kernel Recipes 2026 - Security in the LLM age

The quintessence of it:

The majority of "bugs" AI finds are either not bugs or have been reported already / have been fixed in the last version.

To combat the huge increase in bug reports is to ask a simple task that a genuine bug report can either easily provide or has already done. If they are unable to do so they are very likely an AI bot or a human using AI and can just be ignored.

-4

u/mrlinkwii 16h ago

i agree , but this happened with non AI bug reports , low effert or wrong bug reports isnt a new invention by AI

7

u/The_Real_Random_User 14h ago

To add to the volume aspect.

He mentioned they used to have ~50 bug reports a week. Now they have ~30 a day.

4

u/ABotelho23 16h ago

Again... It's the volume.

2

u/KnowZeroX 15h ago

Has there anyone that finds it wrong to use AI to find bugs? So far I have not seen a single person complain about that. Only the pro-AI people trying to conflate 1 use of AI means you can now use it for everything.

The only complaint about use of AI for bugs is when clueless people who don't even know programming try to use AI to submit bugs they don't even validate or understand themselves wasting reviewers time.

20

u/Farlo1 2d ago

I wouldn’t say “higher risk” but different ones. Humans are also bad at writing code as we’re all discovering.

46

u/witx_ 2d ago

The kernel higher ups really need to start culling the AI crap. How long until a backdoor is pushed to successfully to the kernel because the volume of PRs ia too much?

130

u/TomKavees 2d ago edited 2d ago

See, that's the problem, these are mostly fixes for the old crap that was already b0rked and nobody noticed.

There's a lot of new findings now, but it'll soon go down as people fix things

(Also, you might want to check out Greg K-H's latest talk, it's very on topic)

27

u/IReuseWords 2d ago

The Greg KH talk was excellent. There is also a talk about sashiko, the AI model the kernel team is using.

63

u/lightmatter501 2d ago

Most of these are human written fixes to bugs found with llms.

-8

u/[deleted] 2d ago

[deleted]

24

u/mrlinkwii 2d ago

because thats the linux AI policy

-16

u/[deleted] 2d ago

[deleted]

15

u/Farlo1 2d ago

It doesn’t, but if the code is that good, does it matter? If it’s up to the kernel’s standards and a human is “accountable” for it (the person submitting the PR) then I don’t see the issue.

IIUC their policy is basically that they don’t want AIs throwing slop at the wall without a human in the loop.

-16

u/[deleted] 2d ago

[deleted]

2

u/Clever_Angel_PL 1d ago

no it does not

9

u/ILikeBumblebees 2d ago

how does linux’s ai policy detect if i’ve slopcoded my entire commit but it happens to produce something that looks good

If you've produced good output, then by definition, you haven't "slopcoded" it.

There's nothing particular to AI that even needs to be considered: it's just a matter of accepting good submissions and rejecting bad ones. Any tool that produces good submissions often and bad ones seldom is by definition a good tool.

The challenge here is just accommodating sharp increase in the amount of submissions that need to be scrutinized.

0

u/[deleted] 2d ago edited 2d ago

[deleted]

2

u/Clever_Angel_PL 1d ago

if the quality checking is the exact same system for human and AI, there is no difference

36

u/mrlinkwii 2d ago

The kernel higher ups really need to start culling the AI crap.

may i ask why , these are FIXES that are needed

-26

u/dl33ta 2d ago

A fix can also be a new problem in disguise

19

u/Business_Reindeer910 2d ago

indeed, but you either trust the humans who approve the commits like we've been doing for the past 30+ years or you don't.

-6

u/dl33ta 2d ago

I think the point is that with the surge in PRs coming through it's either backlog or QA drop. With AI the backlog will grow exponentially to the point where humans get overwhelmed and either start culling enmass whereby good code gets thrown or the bar gets lowered and they trust the AI has done a good enough job and let's stuff through, which brings in the problems.

7

u/Business_Reindeer910 2d ago

With AI the backlog will grow exponentially

The people in charge do not think that is going to happen. They expect things to settle down when it comes to the stuff that must be merged (security fixes) while indeed the rest can go to backlog if necessary.

At some point the necessary stuff will reach an equilibrium

1

u/mrlinkwii 2d ago

With AI the backlog will grow exponentially to the point where humans get overwhelmed and either start culling enmass whereby good code gets thrown or the bar gets lowered and they trust the AI has done a good enough job and let's stuff through, which brings in the problems.

i somewhat disagree , that assuming that theirs a push to rush people to QA patches or that people are merging commit just to keep the number down ,

or another option that happening here is putting off merging a large amount of stuff and keeping a backlog the same and merge in the next cycle , this may take longer to merge and approve just to voulume ,i assume no one is demanding stuuff to be merged right away

8

u/mrlinkwii 2d ago

ok and ? that can be said for any fix ever

-7

u/dl33ta 2d ago

If the fix is needed, as you say, does the new problem justify it?

8

u/mrlinkwii 2d ago

im gonna be real having regressions isnt a new thing just becausae AI exist , their have been regressions with 100% human written code ,

regressions will happen thats life , rome wasnt built in a day ,code regressions happen no matter how skilled the team is

reviewers try to minimize regressions but they happen

1

u/marrsd 1d ago

Sure, but you should pick the process that produces fewer regressions over time.

12

u/Virtual-Escape2305 1d ago

Kernel itself now uses AI to review the patches. Seriously. You get a report once you publish a patch to any of their mailing lists. 

Submitting a backdoor is way more difficult now than it used to be.

-13

u/witx_ 1d ago

Sure let's use the tools that can be used to insert backdoora...to review their own code

7

u/Virtual-Escape2305 1d ago

Habe you heard of open models? 

66

u/MatchingTurret 2d ago

need to start culling the AI crap

Your solution is to not fix known bugs just because you don't like the tool used to find it?

4

u/[deleted] 2d ago edited 1d ago

[deleted]

10

u/ILikeBumblebees 2d ago

You mean the part that suggested that releases happening more slowly due to closely scrutinizing all the PRs somehow made it more likely for malware to make it into a release?

-6

u/[deleted] 2d ago edited 2d ago

[deleted]

1

u/ILikeBumblebees 1d ago

What are you talking about? How can the number of new security vulnerabilities be growing at a rate faster than the rate at which new commits are being added to the codebase overall? Do you understand how your entire premise is self-contradictory?

1

u/[deleted] 1d ago

[deleted]

1

u/ILikeBumblebees 1d ago

No. The point of this post is that releases are taking longer because there are more submissions that still need to be vetted.

What does "fixes are being reported" even mean? People are requesting merges of their code into the kernel at an increased rate, so the rate at which the ones that are approved are making it into the kernel is slowing down given current resources.

But new commits to the code are what put exploitable bugs into the codebase the first place, which is why it's important to vet them! The slower release schedule is a result of preventing vulnerabilities from being introduced.

0

u/[deleted] 1d ago

[deleted]

1

u/ILikeBumblebees 1d ago

… the release isn’t taking longer, the submissions are overwhelming the existing release schedule. nowhere does the article say 7.3 is being delayed

Nowhere did anyone say that. We're talking about the release of vetted merges into upcoming kernel revisions.

revealing a previously unknown bug by making a new commit to fix it

Right, at this point it's clear that you're either trolling, or are totally nuts and somehow believe that time and causality flow backwards.

→ More replies (0)

-9

u/witx_ 2d ago

That's what you understood from what I said huh?

-22

u/strings___ 2d ago

Ten years from now the hive mind will ridicule any developer that doesn’t use AI. Unfortunately many Linux users cannot think for themselves

17

u/witx_ 2d ago

AI hive mind and "users can't think for themselves" in the same sentence is hilarious

-5

u/strings___ 2d ago

AI is a tool. If you actually believe it thinks for you, then you’re literally the type of person I’m talking about.

It’s also hilarious that Schrödinger’s AI is both good at finding bugs but also terrible at the same time.

5

u/witx_ 2d ago

I dont think that at all and perhaps I missed your sarcasm because you dont seem to as well.

-6

u/strings___ 2d ago

That was exactly what you were implying. But go ahead and move that goalpost.

8

u/witx_ 2d ago

what? I think we're both a bit lost. I'm not moving goalposts. What I was implying in my initial sarcasm is exactly your point: "these things cannot think for you"

1

u/strings___ 2d ago

The problem is when I said hive mind I meant Linux hive mind and not AI hive mind.

3

u/witx_ 2d ago

That was my misunderstanding then :)

→ More replies (0)

-4

u/Novel_Lie5519 2d ago

you really think it doesn’t think for you? my entire field of research is actively being replaced by it

1

u/strings___ 2d ago

AI predicts output based on input. If you put crap in you’ll get crap out. So no it doesn’t can’t think for you its simply a tool and nothing more.

-4

u/Novel_Lie5519 2d ago

this is just stupid and wrong. read about openai’s recent mathematics drop. i know many people whose years of dissertation work were scooped. 722 of the most important problems in math “solved” in one fell swoop

not ai assisting people skilled in the field, ai autonomously finding problems to solve and then solving them.

unless you’re arguing that producing a result in pure math doesn’t require thinking

0

u/strings___ 2d ago

Im stupid yet you don’t know that LLMs are predictive models?

-3

u/Novel_Lie5519 2d ago

holy jesus fucking christ you’re insufferable

to be abundantly clear, “ai is predictive” does not imply “it can’t think and it’s simply a tool and nothing more”

→ More replies (0)

2

u/AugustinesConversion 1d ago

Treating AI as automatically bad, no matter the context, is an IQ test at this point. Unserious people can't grasp the real productivity gains LLMs offer.

-3

u/witx_ 1d ago

The fact you think IQ points are relevant and a single opinion is a reflexion of its value doesn't go in your favour buddy.

See the opinion of people actually working heavilly with this stuff, and you'll see they don't feel productive (whatever that might mean). Case in point G.K.H from the linux kernel.

2

u/marrsd 1d ago

One solution might be to take the reports as advisory and verify and implement the fix independently. Another might be to run the submitted patch through an AI to check it for exploits. I'd probably go with a belts and braces approach and do both.

1

u/hadrabap 1d ago

I don't use a pair of scissors for network cables.