<h2>What happened</h2>
<p>During the Linux 7.1-rc4 development cycle, Linus Torvalds publicly complained that AI-powered bug hunting tools had made the kernel’s private security mailing list “almost entirely unmanageable.” The problem: dozens of researchers are running the same AI scanning tools, finding the same bugs, and each independently filing them to the private security list — with no way to see that everyone else already reported the same thing.</p>
<p>The private channel was designed for serious, undisclosed vulnerabilities. It’s not meant for speculative, low-confidence findings that a dozen people’s AI tools flagged simultaneously.</p>
<h2>The new documentation</h2>
<p>In response, Willy Tarreau authored new documentation merged into Linux 7.1 that clarifies two things: what actually qualifies as a security bug, and how to responsibly use AI tools when reporting kernel issues.</p>
<p>The core ruling on AI-assisted findings is straightforward: <strong>treat them as public by default.</strong> If multiple researchers are independently discovering the same issue with the same tools, it’s not a secret. Route those reports through normal public channels, not the private security list.</p>
<p>Other guidelines from the new docs:</p>
<ul>
<li>Reports should be concise, plain text, no Markdown</li>
<li>Verify reproducers and proposed fixes before submitting</li>
<li>Don’t speculate about theoretical impact — stick to what you can demonstrate</li>
<li>You can mention that a reproducer exists, but don’t share it publicly</li>
<li>Most bugs being sent to the security team are ordinary bugs, not security issues</li>
</ul>
<h2>The irony</h2>
<p>Here’s the thing: AI tools are genuinely finding real bugs. Three recent local privilege escalation vulnerabilities — CopyFail, DirtyFrag, and Fragnesia — were discovered using AI assistance and are serious enough to be included in stable kernel security fixes. Greg Kroah-Hartman, the kernel’s primary stable maintainer, has been openly running his own AI fuzzing tools (called gkh_clanker_t1000 and gkh_clanker_2000, running on a Framework Desktop with AMD Ryzen AI Max) and staged two dozen fixes over a single weekend covering USB Type-C, input drivers, media drivers, and Industrial I/O code.</p>
<p>So the tools work. The problem is the reporting behavior around them — filing every hit to a private list, skipping verification, and letting someone else do the actual fixing.</p>
<p>Torvalds has been direct about that last part too: if you find a bug, fix it. Drive-by reports with no patch attached aren’t particularly useful.</p>
<h2>What’s in 7.1-rc4 otherwise</h2>
<p>Beyond the AI documentation drama, 7.1-rc4 includes Intel and AMD laptop quirks fixes, a microphone fix for the upcoming Framework Laptop 13 Pro (Intel Panther Lake), support for newer Logitech Bluetooth keyboards via HID++, AMD Dynamic EPP fixes, and an option to disable KVM with CET virtualization to address host hangs. The stable release is expected around mid-June.</p>


Collections

Linus Torvalds flagged that AI-powered bug hunting tools have flooded the Linux kernel's private security mailing list with duplicate, unverified reports, making it nearly unmanageable. In response, new documentation merged into Linux 7.1 establishes guidelines: AI-assisted findings should be treated as public by default and routed through normal channels rather than the private security list, since multiple researchers independently discover the same issues. Reports should be concise, verified, and include a fix where possible. Ironically, AI tools are genuinely finding real vulnerabilities — three recent local privilege escalation bugs were AI-assisted discoveries, and kernel maintainer Greg Kroah-Hartman runs his own AI fuzzing tools. The problem is irresponsible reporting behavior, not the tools themselves.

Linux kernel adds guidance on AI-generated bug reports in 7.1-rc4