Linux Kernel Removes Code After AI Tools Find Real Security Bugs

Linux kernel maintainers are now removing vulnerable code after AI tools successfully identified real security flaws, marking a major shift from earlier unreliable AI-generated bug reports.

A new AI system called DUALLM achieved 87.4% accuracy in finding security problems, successfully identifying 111 potential vulnerabilities in 5,140 recent Linux kernel patches. Of those findings, 90 turned out to be genuine security flaws that needed fixing.

Linux kernel maintainer Greg Kroah-Hartman said AI bug reports have improved dramatically. He noted that while these are often small issues rather than major vulnerabilities, the help is valuable for open source projects that lack resources to manually review all code.

The AI tools focus on finding two specific types of security problems: out-of-bounds memory access and use-after-free vulnerabilities. These flaws can allow hackers to crash systems or potentially gain unauthorized access to devices.

Smaller open source projects may struggle more with AI-generated reports since they have fewer people to verify whether the findings are real problems or false alarms.