"This time around Alexei claims that on the bpf side at least the fixes are now coming in faster than the new reports," Linus Torvalds wrote, a small note of relief in a weekly kernel update that acknowledged an extraordinary year of bug-fixing.
Linus Torvalds and Linux 7.4 rc2
Torvalds published Linux 7.4 rc2 as the second "rough cut" of the next kernel and flagged the release as unusually large. He said he left some code out of rc1 because he was busy and because rc1 was already "the largest such release in the history of the kernel." He also singled out what he described as "various AI fixes" as a defining element of recent activity in the tree.
Anthropic's Mythos and AI-driven bug-finding
Torvalds linked the surge of fixes to new capabilities introduced since Anthropic launched its Mythos bug-finding model in April. According to the report, Mythos has enabled developers to find "more software flaws than was previously possible," a change that has amplified the flow of reported defects into open-source and vendor codebases.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleMicrosoft and Oracle: record months of patches
The scale of that flow is visible in vendor patch numbers cited alongside Torvalds' update. Microsoft addressed a record 974 flaws in September, following earlier monthly spikes of 622 in July and 206 in June — described in the report as Microsoft's "third record fixing spree this year." Oracle handled an even larger single-month total, addressing 1,449 flaws. The story frames these tallies as far more patches than many IT teams are set up to handle.
eBPF, Alexei Starovoitov, and a possible turning point
Torvalds pointed to progress in a specific kernel subsystem: eBPF, the Extended Berkeley Packet Filter project that allows sandboxed programs to run inside the Linux kernel. He credited Alexei Starovoitov, identified in the report as eBPF's co-creator and lead developer, with reporting that "on the bpf side at least the fixes are now coming in faster than the new reports." Torvalds allowed that "most other areas haven't reached that point yet," but said that Starovoitov's observation is "at least a sign that we _may_ be starting to see the tide starting to turn." He tempered optimism with caution: "Don't hold your breath, but maybe cross your fingers we'll be getting there in the not entirely distant future."
What this means for developers, affected enterprises, and adversaries
- Developers and security teams: The Mythos-driven discovery wave has produced a surge of flaws that maintainers and reviewers must triage and patch. Torvalds' note that eBPF fixes may now outpace new reports shows where extra attention and resources may be paying off; other kernel areas, by contrast, "haven't reached that point yet," implying continued strain on review and release processes.
- Affected enterprises and procurement leaders: The vendor patch totals cited — Microsoft fixing 974 flaws in September and Oracle addressing 1,449 in a month — signal unusually heavy update loads for IT operations. The report frames those tallies as "many more patches than IT teams are set up to handle," underscoring the pressure on existing change management and vulnerability-remediation workflows.
- Adversaries and threat actors: The piece states that attackers are "increasingly targeting flaws found by AI," creating an urgency for faster fixes and coordinated responses. The apparent slowdown in new eBPF reports could redirect adversary focus to subsystems still experiencing a net inflow of AI-found bugs.
The takeaway is pragmatic and cautious. The Linux kernel — a codebase the report describes as "40-million-plus lines of code" and "one of the world's bigger software projects" — has been battered this year by a new, AI-enabled torrent of bug reports and corresponding patches. Torvalds' note that at least one high-profile area, eBPF, may now be seeing fixes outpace new reports offers a calibrated hint that the acute phase of the "patchpocalypse" might be easing. But his own caveat — "Don't hold your breath" — and his observation that most other areas have not reached the same point leaves the larger question open: whether the flood of AI-discovered flaws across the rest of the kernel will similarly subside.
