The Library Media — Science, Technology & Health · AI News & Intelligence Desk
By Catalina Clarke
Follow The Library Media
For months, the story of AI in open-source software has been a story about volume: tools that find flaws faster than the humans who maintain the code can fix them. On Sunday, in one corner of the Linux kernel, the flow may have started to run the other way.
Linus Torvalds released Linux 7.4-rc2, the second release candidate of the next kernel, in his weekly announcement on November 8. He rated the release big for two reasons — code that had been held back from the first release candidate, and the continuing stream of what he called “various AI fixes” — and described its diffstat as “fairly benign.”
The notable line concerned bpf, the kernel technology that runs small sandboxed programs inside the operating system, co-created and led by Alexei Starovoitov. “This time around Alexei claims that on the bpf side at least the fixes are now coming in faster than the new reports,” Torvalds wrote, “and that sounds lovely if true.”
He hedged it immediately, and the hedge is part of the news. “I think most other areas haven’t reached that point yet, but it’s at least a sign that we may be starting to see the tide starting to turn,” he added. “Don’t hold your breath, but maybe cross your fingers we’ll be getting there in the not entirely distant future.”
If the bpf report holds, it is the first subsystem to say so. The flood it answers began in earnest this spring: since Anthropic launched its Mythos bug-finding model in April 2026, developers have been able to surface software flaws far faster than before, and the resulting volume of reports and fixes has strained projects well beyond Linux. The Register notes that Microsoft fixed a record 974 flaws in September 2026, and Oracle addressed 1,449 in a single month.
The scale of the current kernel cycle shows the same pressure. The first 7.4 release candidate, on November 1, contained approximately 19,671 commits — a record for a first release candidate. A tally of the merge window by XenoSpectrum’s editorial team counted 3,008 AI-assisted non-merge commits, about 2.4 times the prior cycle’s figure. That number comes with its own caveat, which the tally itself flags: the AI tag was abolished partway through the window, so the count is a floor arrived at by an editorial methodology, not an official kernel statistic.
Torvalds’s rc1 note had already pointed at a healthier shape for the work. He wrote then that he was “much happier” that AI-triggered work arrived inside the merge window — the period when a new kernel absorbs change — rather than landing as extra fixes during stabilization, calling it “a much healthier model,” and he noted that AI-suggested patches “often get rewritten” by the humans who review them. Fixes outpacing reports in bpf would be the next step of that same pattern: not fewer flaws found, but a pipeline that has learned to clear them as fast as they surface.
What has not happened yet matters as much. No subsystem other than bpf has reported fixes outpacing reports. Release candidates arrive weekly, and the third one could reverse the signal entirely — a point XDA’s coverage of the announcement makes plainly. And the counts behind the story rest on tagging that the project itself discontinued mid-window, which limits how precisely anyone can measure the trend the quotes describe.
So the honest summary is Torvalds’s own. One subsystem reports the tide turning. Most have not reached that point. It may be starting — and the man who wrote the sentence underlined the “may” himself.
Catalina Clarke
Editor-in-Chief, The Library Media
From The Library — the estate of our family.