AI tools are flooding Linux maintainers with duplicate vulnerability reports

Linux kernel maintainers have run into an unexpected problem: AI vulnerability-hunting tools generate so many bug reports that volunteers simply can't process them in time. Thousands of duplicate and low-quality reports are stalling work on real security issues.

The scale of the flood

The wave of automated reports grows every week. AI tools trained on source code scan Linux for potential vulnerabilities and file bug reports automatically. The problem is that the algorithms produce many duplicates of the same issue, from different tools, in different formats and with different levels of detail.

Maintainers are mostly volunteers who work in their spare time. Each report has to be read, understood and checked for reproducibility, and then someone must decide whether it is a real vulnerability or a false positive. When hundreds of reports arrive per day, the process freezes.

Why AI creates noise

Over the past two years, LLMs such as ChatGPT, Deepseek and Claude have become more accessible and more powerful. Enthusiasts and companies have launched automated scanners built on these models to look for vulnerabilities. On paper, this sounds useful: extra eyes on the code. In practice, it creates an information overload problem.

AI often flags code that looks suspicious but is actually safe in the context of Linux. The models don't always understand the kernel's particularities, its security architecture and its existing protections. The result is hundreds of "findings" that turn out to be useless.

The consequences are already visible

The influx of noisy reports is affecting the development process:

• Real critical vulnerabilities get lost in the stream of duplicates and false positives
• Maintainers have to spend time on triage instead of coding
• Some volunteers threaten to step back from the project because of fatigue
• Patching of real problems is slowing down
• Code review is becoming more tiring and slower

Developers have proposed creating a separate filter or quarantine for AI reports, to physically separate them from reports written by humans.

What this means

It's a paradox: tools that are supposed to improve security are actually making it harder. AI is useful for finding patterns, but it needs human filtering and an understanding of context.

The Linux community may face a choice: either close the bug tracker to automated tools, or create a procedure for verifying reports before they are published.