Linux 7.4-rc2: Torvalds Sees the AI Bug-Report Flood Starting to Turn
Key takeaway: Linux 7.4-rc2, released on November 8, 2026, carries the first sign that the flood of AI-generated bug reports may be peaking: in the eBPF subsystem, fixes now land faster than new reports arrive, according to lead developer Alexei Starovoitov. Linus Torvalds called it an encouraging sign — but warned that most of the kernel has not reached that point yet.
What happened with Linux 7.4-rc2
Linus Torvalds released Linux 7.4-rc2, the second release candidate of the next Linux kernel, on Sunday, November 8, 2026. He rated it a big release for two reasons: it includes code he held back from the first release candidate while he was travelling, and it carries what he called “various AI fixes” — patches for flaws found by AI bug-hunting tools.
The release candidate follows the largest merge window in the kernel’s history. Linux 7.4-rc1 contained about 19,671 commits, against a typical figure of roughly 15,000. Of those, 3,008 non-merge commits carried AI assistance — about 2.4 times the figure from the previous 7.3 cycle. Torvalds described the rc2 diffstat as “fairly benign,” with the changes split into rough thirds: drivers (mostly GPU, networking, and sound), networking and eBPF, and everything else, mainly filesystems, memory management, and architecture code.
Much of rc2’s bulk comes from automated Coccinelle cleanup scripts — thousands of small one- and two-line changes Torvalds received during the merge window and held back because he was on the road.
Why the eBPF numbers matter
The headline number is in eBPF, the kernel technology that runs small, sandboxed programs for networking, observability, and security. Starovoitov, who co-created eBPF and leads its development, reported that fixes in that subsystem are now arriving faster than new AI-generated bug reports. Torvalds quoted him in the release announcement: “This time around Alexei claims that on the bpf side at least the fixes are now coming in faster than the new reports, and that sounds lovely if true.”
That matters because eBPF is the first subsystem to reach this tipping point. Since Anthropic launched its Mythos bug-finding model in April 2026, AI tools have been finding software flaws far faster than developers could fix them — a wave the kernel community calls the patch flood. The surge has strained projects well beyond Linux: Microsoft fixed a record 974 flaws in September, its third record month of 2026 after 622 in July and 206 in June, and Oracle addressed 1,449 flaws in a single month. Attackers are also increasingly targeting flaws found by AI, which makes clearing the backlog urgent rather than optional.
How this compares with the rest of the kernel
Torvalds was careful not to declare victory. “I think most other areas haven’t reached that point yet, but it’s at least a sign that we may be starting to see the tide starting to turn,” he wrote. “Don’t hold your breath, but maybe cross your fingers we’ll be getting there in the not entirely distant future.”
The comparison is the point. eBPF has a small, focused maintainer group, heavy automated testing, and a verifier that catches bad code early — conditions that let fixes move quickly. Larger, more sprawling subsystems such as drivers do not have the same setup, so their backlogs are still growing. The Linux kernel is more than 40 million lines of code, and if AI keeps finding flaws in other subsystems at the current rate, the overall patch volume will stay high even as eBPF clears its queue.
What it costs IT teams right now
For anyone running Linux in production, the practical cost of the flood is patch volume. Every AI-found flaw that turns into a real fix still has to be tested, packaged, and deployed — and the record months at Microsoft and Oracle show the same pressure across the industry. The eBPF turnaround suggests the fix pipeline can catch up where the tooling and review capacity exist. Until more subsystems reach that point, expect kernel updates to keep arriving thick and fast, and keep patching schedules tight.
Linux 7.4-rc2 is a test release aimed at developers and testers, not general users. The stable release is expected around December 20, 2026, according to kernel maintainer Greg Kroah-Hartman. One process change is worth noting: the kernel project recently dropped its “Assisted-by” tag for disclosing AI assistance in patches. Torvalds’ standing position, repeated this cycle, is that AI work belongs in the merge window as normal development, not dumped into the stabilization period, and that human review and sign-off remain required.
Analysis: a turning point, not a victory lap
Analysis: The eBPF milestone is real but narrow. It proves that an AI-driven bug-finding wave can be absorbed when a subsystem has strong automation and a tight review loop. But Torvalds’ own framing is the honest read: one subsystem out of many, and a warning not to hold your breath. The broader story of 2026 is still that AI finds flaws faster than humans fix them, and the industry-wide record patch months show the backlog is a shared problem, not a Linux-only one. Watch the next two release candidates: if a second or third subsystem reports the same crossover, the tide really is turning.
What to watch next
Three things will show whether this is a trend or a one-off. First, whether other subsystems report fixes outpacing reports in the rc3 and rc4 announcements. Second, whether the total commit count falls back toward the usual ~15,000 in the 7.5 cycle. And third, whether the stable 7.4 release lands on schedule in December with no late flood of AI-reported regressions.
What is Linux 7.4-rc2?
Linux 7.4-rc2 is the second release candidate of the upcoming Linux kernel version 7.4, released by Linus Torvalds on November 8, 2026. A release candidate is a near-final test version: developers and testers try it and report problems before the stable release, which is expected around December 20, 2026.
What did Linus Torvalds say about AI bug reports?
Torvalds said eBPF lead developer Alexei Starovoitov reports that fixes in the eBPF subsystem are now arriving faster than new AI-generated bug reports. He called it a sign the tide “may” be starting to turn, while stressing that most other parts of the kernel have not reached that point yet and advising readers not to hold their breath.
What is eBPF and why does it matter here?
eBPF, the Extended Berkeley Packet Filter, is a kernel technology that lets small, sandboxed programs run safely inside the Linux kernel for networking, observability, and security tasks. It matters here because it is the first kernel subsystem where fixes are outpacing new AI-found bug reports, showing the patch flood can be absorbed where review and testing are strong.
Why did AI bug reports flood the Linux kernel in 2026?
The flood began after Anthropic launched its Mythos bug-finding model in April 2026. AI tools started finding software flaws far faster than developers could fix them, pushing Linux 7.4-rc1 to a record of about 19,671 commits, including 3,008 AI-assisted commits. The same pressure produced record patch months at Microsoft and Oracle.
When will stable Linux 7.4 be released?
The stable Linux 7.4 release is expected around December 20, 2026, according to kernel maintainer Greg Kroah-Hartman. The exact date depends on how the remaining release candidates go — any serious late regressions could push it back.
Sources: The Register — Linus Torvalds sees signs AI-prompted patch flood has peaked; WebProNews — Torvalds Sees an Early Sign the Kernel’s AI Bug-Report Wave May Be Turning; OSTechNix — Linux Kernel 7.4 RC2 Released.
Related reading: OpenAI’s AI Built 948 Working Linux Root Exploits in One Run; One Hacker’s AI Agents Breached 100+ Company Sites for About $50 Each.
