Skip to content
audiotale.net
Sign in
NewsNews

Linux 7.4-rc2: Torvalds says AI-prompted fixes may be peaking, BPF now fixing faster than reports

Linus Torvalds relays that BPF fixes now outpace new reports after the biggest merge window on record, with 19,671 commits in Linux 7.4's.

audiotale.net team

· 7 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What happened
  3. Background
  4. The numbers
  5. What it means
  6. What we don't know yet
  7. What to watch next
  8. Sources

Linus Torvalds released Linux 7.4-rc2 on 8 November 2026 and said that in the kernel's BPF subsystem, bug fixes are now arriving faster than new bug reports. It is the first sign from a senior maintainer that the flood of AI-prompted patches that has swollen every recent kernel cycle may be starting to ebb, although Torvalds himself says most other areas have not reached that point and warns people not to "hold your breath". For anyone who ships, packages or depends on Linux, the numbers behind the story show how much the pace of kernel development has changed in a year.

Key points

  • Linux 7.4-rc2 was announced by Linus Torvalds on 8 November 2026; he calls it a big -rc2 that follows the largest -rc1 in kernel history.
  • Torvalds relayed that BPF maintainer Alexei Starovoitov says that on the BPF side fixes are "now coming in faster than the new reports", but that most other areas are not there yet.
  • Phoronix counted 19,671 commits in the 7.4 merge window, a record, against 16,267 for Linux 7.3 (figures as reported by It's FOSS); Torvalds himself puts it at "almost 20k" against a usual 15,000 or so.
  • Much of rc2's bulk is automated Coccinelle clean-ups that Torvalds held back from the merge window, not AI fixes alone.
  • Torvalds has said 7.4 is expected to become the next long-term support (LTS) kernel, which may have played a minor part in the size of the window.

What happened

Torvalds published the rc2 announcement on the Linux Kernel Mailing List on 8 November. He describes it as a big -rc2 for two reasons. First, it follows the biggest -rc1 the project has seen. Second, it carries a large batch of automated Coccinelle updates that he left out of the merge window because he was travelling and did not want to handle them then. Those scripted changes are mostly one- and two-line edits spread across many files, which adds noise to the diffstat without adding much risk.

Filter those out, he says, and what remains falls into three rough thirds: drivers (mainly GPU, networking and sound), networking plus BPF, and everything else, mainly filesystems, memory management and architecture code. He also says that much of the work was driven by AI-generated fixes and that he will stop repeating the point.

The part that drew attention is a relayed observation. Torvalds writes that Starovoitov, a co-creator of eBPF and its lead developer, reports that on the BPF side "the fixes are now coming in faster than the new reports". Torvalds adds that this "sounds lovely if true", and that most other areas have not reached that point yet, but that it may be a sign that the tide is starting to turn. He closes by asking people to keep testing and says not to hold their breath. The changelist for rc2 lists about 40 commits credited to Starovoitov, many in BPF, covering areas such as arena mmap handling, may_goto time slices, kfunc argument checks, lwt_in programs and dynptr safety. Chris Mason appears with about 33 entries, many of them BPF and memory-management changes.

The Register, which reported the rc2 post on 9 November, frames it as a possible peak in what it calls the AI-prompted patch flood. That reading is cautious by design: it rests on one maintainer's impression of one subsystem, passed along by Torvalds with an explicit hedge.

Background

The surge did not start with 7.4. Torvalds described the volume in Linux 7.2's later release candidates as a "new normal" driven by AI tools reviewing code, and he joked about AI when he released 7.3-rc2 on 6 September 2026. The cause is the arrival of tools that find real bugs at scale. The Register dates Anthropic's Mythos bug-finding model to April 2026, when it reported the model could find and exploit zero-day flaws, and has tracked the effect on vendors since.

The effect is visible well beyond the kernel. By the Register's count, Microsoft fixed 206 CVEs in its own products in June 2026, 622 in July and 974 in the September Patch Tuesday, a record; its August release had 421. The Register also reported that Oracle shipped 1,449 fixes in a single month in July. The common thread is the same one the kernel is experiencing: a backlog of defects, found faster than before, being worked through by humans who still have to review, test and merge each fix.

For Linux, the pressure showed up in the merge window itself. Torvalds opened 7.4 after a family vacation and warned that merging might need an extra week; in the end -rc1 still arrived on the usual two-week schedule, on 1 November.

The numbers

Phoronix's count of commits per merge window, which goes back to Linux 3.1 in 2011, puts 7.4 at 19,671, the highest it has recorded. The previous record was Linux 7.3 at 16,267, so 7.4 beat it by more than 3,400 commits. According to It's FOSS's summary, every merge window since 7.0 has been bigger than the one before it. Torvalds' own count, "almost 20k", compares with a typical window of about 15,000. Counting methods differ: one outlet gives 19,780 over 13.92 days, and Torvalds did not say whether his figure includes merge commits, so treat the exact total as approximate.

Commits in the Linux merge window (Phoronix count)commits
Commits in the Linux merge window (Phoronix count) (commits)
commits
Linux 7.316267
Linux 7.419671

Source: Phoronix, as summarised by It's FOSS

The source tree also grew. Before -rc1 on 1 November it stood at 41,605,120 lines, up from 41,019,555 at the 7.3 release, according to the same summary. Those totals include blank lines and comments, so the growth in actual code is smaller. About a third of the 7.4 patch is AMD GPU header files, which hold register definitions and which Torvalds tells readers to ignore; drivers make up about half the patch, or about two-thirds with those headers.

How much is AI? One independent count, by XenoSpectrum, found 3,008 commits in the 7.4 window carrying an "Assisted-by" tag, about 2.4 times the number in 7.3. That tally covers only commits that declare AI use, so it understates AI's share if some patches go undeclared and says nothing about quality. We could not verify the count against the kernel tree ourselves.

Microsoft CVEs fixed per Patch Tuesday, 2026CVEs
Microsoft CVEs fixed per Patch Tuesday, 2026 (CVEs)
CVEs
Jun206
Jul622
Aug421
Sep974

Source: The Register

What it means

For kernel maintainers, a world in which fixes outnumber new reports is the point at which the backlog starts to shrink instead of grow. Starovoitov's remark suggests BPF, a relatively well-tooled subsystem, may get there first. Subsystems with fewer reviewers or less test infrastructure may take longer, which fits Torvalds' caution.

For distributions and device makers, the practical issue is timing. Torvalds has said he prefers AI-driven fixes arriving during the merge window rather than piling into release candidates, calling that "a much healthier model". Fixes that land early get more testing before a release, which matters because 7.4 is widely expected to become the next LTS kernel, the version many distributions and Android vendors will carry for years. Torvalds said that expectation may have contributed a little to the size of the window, and he treats it as a factor separate from AI.

For security teams, the lesson from the Microsoft and Oracle figures is that large patch volumes are a feature of the new landscape, not a blip. The Register has argued that attackers are also using AI to target newly found flaws, which shortens the time to patch. Torvalds' remark is about the supply of bugs in one subsystem, and it does not change that advice.

What we don't know yet

  • Whether the BPF experience generalises. Torvalds says most areas are not there yet, and the only evidence offered is one maintainer's impression.
  • How many of the rc2 changes are AI-originated. The Coccinelle changes are scripted but not AI fixes, and the "Assisted-by" count only reflects declared use.
  • Whether the rc3 to rc7 period will be quieter. Torvalds said in earlier coverage that "we'll see how the -rc's look".
  • When 7.4 will ship. The sources we read give no release date.
  • The quality of the AI-found fixes. Torvalds has said they often get rewritten, and the review burden on maintainers has not gone away.

What to watch next

Watch the size of rc3 and rc4 in Torvalds' weekly announcements: if the AI fix flow is peaking, the rc diffs should shrink sooner than in the 7.2 and 7.3 cycles. Watch whether other maintainers echo Starovoitov. Watch the December and January Patch Tuesday and Oracle counts for the same signal outside the kernel. And watch the final 7.4 announcement for any confirmation that it is the LTS kernel.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next