Linux kernel tightens security rules for AI-generated reports

Linus Torvalds, the lead maintainer of the Linux kernel, has declared that the project's security mailing list has become "almost entirely unmanageable" due to a flood of duplicate bug reports generated by artificial intelligence tools. The issue was highlighted in his weekly update announcing the fourth release candidate for Linux 7.1.

Torvalds stated that the "continued flood of AI reports" has overwhelmed the private security list with enormous duplication, as different researchers using the same tools frequently identify the same flaws. This has created what he called "entirely pointless churn," where maintainers spend their time forwarding reports to the correct people or informing reporters that a bug was already fixed weeks or months ago, rather than writing code.

He emphasized that bugs discovered via automated AI tools are, by definition, not secret vulnerabilities, and routing them through a private list only worsens the duplication problem because reporters cannot see each others' submissions. In response, the Linux kernel project has merged updated documentation that formally defines what constitutes a true security vulnerability and establishes new rules for...