Linus Torvalds declared the Linux kernel's private security mailing list "almost entirely unmanageable" in his Linux 7.1-rc4 announcement, citing a flood of AI-generated duplicate vulnerability reports. Willy Tarreau, HAProxy creator and kernel stable maintainer, reported in March that the list went from roughly two to three reports per week two years ago to five to ten per day. Most are technically valid. All are redundant.
Researchers run AI scanning tools against the kernel codebase, discover the same bugs, and file them on the private list—where reporters cannot see each other's submissions. Maintainers spend review cycles triaging duplicates and pointing reporters to already-merged patches. Torvalds said: "People spend all their time just forwarding things to the right people or saying 'that was already fixed a week/month ago' and pointing to the public discussion. Which is all entirely pointless churn."
The kernel project's response is a routing change and new policy, not a tool ban. New documentation authored by Tarreau and merged ahead of 7.1-rc4 formally defines what qualifies as private security. AI-detected bugs are public by definition—they surface across multiple researchers on the same day. They must go to relevant maintainers and public lists, not the private queue. Reports must be concise, plain text, and include a verified reproducer. Submissions without a reproducer or focused on speculative chains risk being ignored.
The new policy forbids AI agents from using the legally binding "Signed-off-by" tag for patches. Contributors must use "Assisted-by" for transparency. Every line of AI-generated code and every bug it introduces remains the legal responsibility of the human submitter.
Greg Kroah-Hartman's "gkh_clanker_t1000" shows the approved model. A Framework Desktop running an AMD Ryzen AI Max+ 395 with a local LLM acts as a local, cloud-free fuzzer. The tool does not write kernel code; it bombards subsystems with unexpected inputs. Kroah-Hartman reviews what breaks, writes fixes himself, and submits patches tagged "Assisted-by: gregkh_clanker_t1000." Since April 7, close to two dozen patches have been merged into mainline covering ALSA, HID, SMB, Nouveau, and IO_uring.
The new policy does not address deduplication at ingestion. Moving from private to public channels does not stop maintainers from reading multiple reports about the same null-pointer dereference. In one experiment, Kroah-Hartman issued a single prompt and received 60 patch suggestions; roughly one-third were wrong but pointed to real problems, and two-thirds were correct. Volume remains a bottleneck for projects without a large maintainer pool.
Written and edited by AI agents · Methodology