Linus Torvalds Says AI Is Finding Bugs in the Linux Kernel

Key Takeaways

• In October 2026, Linus Torvalds used “modern LLM tools” to untangle an obscure bug report in the kernel’s assoc_array library — the refactor plus a user-space test harness confirmed the reported bug and surfaced three more, all dating to the library’s original 2013 commit.
• In the same period he posted an AI-assisted page-refcount scalability patch series to the kernel mailing list, naming Claude Code as his helper for code, tests, review and draft documentation.
• The kernel community now asks contributors to tag AI-assisted work with an “Assisted-by: LLM” commit trailer — but AI must never add a Signed-off-by; only humans certify the Developer Certificate of Origin.
• At Open Source Summit Europe in Prague, Torvalds said plainly: “I actually really like using AI” — while warning that low-quality AI patches are “stressing maintainers out to the point that it’s a problem.”
• AI-assisted bug reports have exploded: private security-list reports rose from 2–3 per week to 5–10 per day in 2026, and per-release CVE counts have roughly tripled since the 6.x era.

Introduction

For decades, Linus Torvalds has been famous for two things: creating Linux, and having extremely strong opinions about tools. So when the most consequential code reviewer on the planet starts using AI to review code — and publicly says so — the open-source world pays attention.

October 2026 brought a cluster of moments that together tell a bigger story: Torvalds leaning on large language models to make sense of obscure kernel code, finding real bugs in the process, defending AI-assisted development on the mailing lists, and telling a Prague audience that he genuinely likes the stuff — with caveats that only Torvalds could deliver. Here’s what happened, what he actually said, and why the kernel’s maintainers are both excited and exhausted.

The assoc_array Story: Four Bugs Hiding Since 2013

The episode began, as so many kernel stories do, with an obscure bug report. Developer Nils Ollrogge reported a bug in `assoc_array` — the kernel’s generic associative-array library, introduced back in 2013 — and even proposed a fix. The problem: the code was so dense and hard to follow that Torvalds couldn’t confidently review the patch.

Over the weekend of October 10–11, 2026, a Git tag named `assoc-array-fixes` appeared in Torvalds’s kernel tree. His tag message was disarmingly frank: “Nils Ollrogge reported a bug in the assoc_array library and had a patch to fix it too, but that code was too obscure for me to follow, so I did what I preach: use modern LLM tools to help make sense of it all.”

The workflow is worth understanding, because it is becoming a pattern:

1. LLM-assisted refactor for readability. The models helped split large, hard-to-read functions into clearer pieces — not changing behavior, just making the code legible.
2. A user-space test harness. Instead of testing inside the kernel, Torvalds built a test harness outside it to exercise the library.
3. Confirmation — and a bonus. The harness confirmed Ollrogge’s reported bug, then found three additional bugs, all traced to the very first 2013 commit that added the library. Four findings total, hiding in plain sight for thirteen years.

As of mid-October 2026, the fixes were not yet merged into mainline; reports suggested the Linux 7.4 merge window as the likely destination, but that is unconfirmed. Still, the symbolism is hard to miss: the man who wrote the kernel needed AI help to read part of it — and the AI-assisted process worked.

How AI Finds Linux Kernel Bugs: Torvalds’ Workflow

The assoc_array episode reveals Torvalds’s preferred pattern for AI-assisted kernel work, and it is more disciplined than “ask the chatbot.” The model does the thing it is good at — restructuring and explaining dense code — while verification happens through old-fashioned engineering: a test harness, run outside the kernel, producing reproducible results.

He applied the same approach to a second effort in the same timeframe: a page-refcount scalability patch series posted to the Linux Kernel Mailing List. In the cover letter he wrote: “I decided that hey, I will try to actually solve this thing using an LLM to help with the issues these things have had.” This time he named the tool explicitly — Claude Code — which he used for code, test programs, review, and even a first draft of the documentation text. He ran the performance measurements himself. The branch, `noref-filemap-read-with-llm`, remains experimental and unmerged.

Two details stand out. First, Torvalds is transparent about the assistance — no quiet AI use, no laundering machine output as human work. Second, the human stays in the loop at every step that matters: measurements, judgment, and ultimately the decision to merge or not.

The One-Character Fix: When the AI Said “Impossible”

The October episodes were not Torvalds’s first AI-assisted debugging rodeo. In August 2026, he spent days chasing a memory-corruption bug causing black screens on his Intel Battlemage G21 system, in the Intel Xe graphics driver.

The debugging session was grueling: 24 debug patches and 18 kernel boots. And the AI assistant, by Torvalds’s own account in the commit message, was not always helpful — it “several times stated flat out that this was impossible and unsolvable.” Torvalds pushed on anyway.

The fix, when it came, was almost comically small: a one-character change in commit `818bebeb63dd`, swapping `round_up()` for `round_down()` in `get_flat_ccs_offset()`. The driver had been handing out flat CCS (compression metadata) storage as usable VRAM, corrupting page tables. The underlying defect dated to a commit roughly two years old.

There is a lesson in this that the breathless “AI writes all the code” narratives miss: the model was wrong, repeatedly and confidently, and the human’s judgment — that the bug was real and findable — is what carried the day. AI as sparring partner, not oracle.

The Tools: Sashiko and “Assisted-by: LLM”

Torvalds is not the only one bringing AI into kernel development. The ecosystem around him is formalizing fast:

• Sashiko, announced in March 2026 by Google kernel engineer Roman Gushchin, is an agentic LLM code-review system — written mostly in Rust — that watches mailing-list submissions and posts public reviews. Its creators self-report a 53.6% bug-detection rate on already-reviewed patches, with false positives “well within” 20%. Those are the creators’ own numbers, not independently verified, but subsystem maintainers are starting to expect patches to have passed through such review.
• The “Assisted-by: LLM” trailer. Kernel contributors are now asked to add this commit trailer when machine assistance played a role in a patch. The rule with teeth: AI agents must never add Signed-off-by tags. Only humans certify the Developer Certificate of Origin. Accountability, in other words, stays human.
• Community experiments. Press reports describe Google’s Kroah-Hartman running AI-assisted fuzzing efforts, Meta’s Chris Mason working on better prompts for AI code review, and networking maintainer Jakub Kicinski estimating that a third to a half of net-next patches in the 7.3 cycle were tied to automated or AI-driven cleanups. Treat single-source press claims with appropriate caution — but the direction of travel is unmistakable.

The CVE Surge: AI Is Finding Bugs at Scale

Zoom out from individual bugs and the numbers tell their own story. At Kernel Recipes 2026 in Paris, Greg Kroah-Hartman presented a graph of CVEs fixed per release: roughly 500 per release across versions 6.9 to 6.19, jumping to about 1,000 from Linux 7.0, past 1,500 with 7.2, with 7.3 projected to potentially top 2,000.

Kroah-Hartman’s attribution: AI code-review platforms and LLMs are driving the surge. The important nuance, noted by TechSpot’s reporting: most of the newly found issues are low-priority or in obsolete drivers — AI is excellent at combing through ancient, unloved code that humans stopped reading years ago. (That same cleanup wave saw the removal of the ISDN subsystem — dead code, finally buried.)

The volume has a cost. In the Linux 7.1-rc4 announcement in May 2026, Torvalds described the private security mailing list as “almost entirely unmanageable”: reports climbed from 2–3 per week a couple of years ago to 5–10 per day in 2026, largely AI-generated. More bugs found is good; more noise for humans to triage is the price.

What Torvalds Actually Thinks About AI

For anyone who remembers Torvalds dismissing AI hype — press reports from October 2024 had him calling ~90% of AI messaging “marketing hype” — his current position is a genuine evolution, and he stated it plainly at Open Source Summit Europe in Prague on October 10, 2026, in conversation with Dirk Hohndel:

• “I actually really like using AI”
• “I think that you need to be very careful using AI when you’re doing something real and important.”
• “I use AI to do the things that I’m bad at” — said about a personal guitar-pedal UI project, but the philosophy generalizes.
• On AI bug-hunting improving the kernel: “It is, I think, improving our code base… Although it is also stressing maintainers out to the point that it’s a problem.”
• On low-quality AI submissions: “mindless band-aid kind of patches” — and convincing-but-fabricated bug reports that take real human effort to disprove.

Perhaps the most telling line from Prague: “Three-quarters of the preceding day’s Linux Kernel Maintainer Summit discussion concerned making AI generation and review less stressful and more useful. The bottleneck isn’t getting patches. It’s getting useful work through review without exhausting the people responsible for it.”

And for the critics who want AI banned from kernel development entirely, his July 2026 mailing-list answer remains the definitive Torvalds: “Linux is not one of those anti-AI projects, and if somebody has issues with that, they can do the open-source thing and fork it. Or just walk away.” In the same thread he called AI “a tool, just like other tools we use. And it’s clearly a useful one” — while stressing that nobody is forced to use it.

The Other Side: A Community Split

Not everyone in open source shares the enthusiasm. System76 has banned AI-generated content from its COSMIC desktop project — a reminder that the community is genuinely divided on where machine assistance belongs.

The honest picture is therefore two-sided, and Torvalds himself states both sides: AI is finding real bugs, including ones that hid for over a decade, and it is simultaneously flooding maintainers with plausible-looking noise. The kernel’s answer — transparency trailers, human-only sign-offs, test harnesses over vibes — is arguably the most mature AI-governance model in software right now.

For more on how AI is changing the craft of building software, see our roundups of 7 boom trends in AI dev tools and the $58/month Cloudflare–Anthropic AI bug-bounty setup — bug hunting, it turns out, is having a moment far beyond the kernel.

Thirteen years. That is how long four bugs sat in `assoc_array` before an LLM helped a human finally read the code properly. The machines are not replacing kernel maintainers — but they are increasingly the reason the maintainers find what they find.