Greg Kroah-Hartman, who oversees the stable Linux kernel, has warned that the in-development Linux 7.3 is shaping up to be another rough cycle. The cause is not a security hole or a design flaw, but the sheer volume of bug fixes that AI tools are finding and submitting. The 7.3-rc1 release published on August 30 is one of the largest in kernel history, and the number of vulnerabilities logged per release is closing in on 2,000.

More Than 4,000 Unhandled Patches in One Inbox

Kroah-Hartman described the state of his mailbox for the USB subsystem on social.kernel.org, the developer-focused social platform. The backlog built up over a few weeks ran well past 4,000 messages and tens of megabytes. Even after a first pass that cleared the obvious bug fixes and the older submissions already superseded by newer versions, more than 4,000 messages remained. In his own words, it was still crazy.

The awkward part is that the pile cannot be discarded mechanically. He pushes back on many AI-generated submissions, but says he does not want to flatly refuse something that is obviously a bug fix. Judging a patch requires reading it, and the reading itself consumes maintainer time. That is where the bottleneck sits.

For the staging tree he also maintains, he has adopted a policy of not accepting AI or LLM-generated patches except for genuine security fixes. It is not a blanket ban, but a way to close off the noisiest area first.

7.3-rc1 Is the Second-Largest Merge Window Ever

The 7.3 merge window pulled in 15,267 commits over two weeks, closing as the second-largest in kernel history. Counting comments and blank lines, the tree reached roughly 40,980,000 lines, up sharply from 40,420,000 in Linux 7.2. Of that total, about 30,940,000 lines were detected as actual code, about 4,910,000 lines were comments, and about 5,130,000 lines were blank.

AI is not the main driver of that growth. Close to a third of the rc1 patch consisted of AMD's DCN6 display register headers and related code for its next graphics generation. As a result, the AMD graphics driver directory alone now runs to roughly 6,520,000 lines, about 16 percent of the entire kernel. When enormous machine-generated header files land in one go, the line count jumps.

Elsewhere, 7.3-rc1 brought AMD Zen 6 enablement, Btrfs performance work, and support for the 2026 Steam Controller. The stable release is targeted for October 18, and could slip a week to October 25 if the closing weeks turn out to be brutal.

Vulnerability Counts Approaching 2,000 per Release

More telling than the patch volume is the number of issues registered as CVEs. According to a slide Kroah-Hartman used to preview his Kernel Recipes 2026 talk, the count sat around 500 per release through much of the 6.x era, passed 1,000 with Linux 7.0, and cleared 1,500 with Linux 7.2. If the trend holds, 7.3 will reach 2,000.

This does not mean Linux suddenly became fragile. It reflects investigators armed with AI tools sweeping a codebase that has grown past 40,000,000 lines over 35 years. Most of what gets filed is either low priority or tied to drivers and features that are already obsolete.

USB maintainers are not the only ones feeling the strain. Jakub Kicinski, who maintains the networking side, reported in the 7.3 pull request that between a third and half of the 648 net-next patches handled during the cycle looked like low-priority AI-driven fixes, clean-ups, or clarifications, and added that the team is completely overwhelmed.

Static Analysis Tools as the Source

Kroah-Hartman notes that the huge majority of incoming patches originate from static analysis tooling. What they surface tends to be very old, minor issues that can only be triggered if you hold it wrong. Technically the reports are not wrong. Whether any user is actually affected is another matter. They still register as valid reports, so the cost of triage falls on maintainers.

There has been an upside. The wave of AI-driven bug reports prompted a cleanup earlier this year that removed a batch of old drivers along with the entire ISDN subsystem, which had been sitting on dozens of CVEs. Taking inventory of neglected code is a real benefit.

The problem is that the manpower has not scaled to match. For several months Kroah-Hartman has been telling audiences that it is going to be a long 18 months, and he says that number does not seem to be getting any shorter.

Summary

Linux 7.3 is heading toward its October release carrying a large volume of AI-generated bug fixes and vulnerability reports. The 7.3-rc1 snapshot came in at 15,267 commits and more than 40,980,000 lines, the second-largest merge window on record, while CVE registrations are on track to approach 2,000 per release. Most of the findings are old and minor, but because obvious fixes cannot be rejected out of hand, the verification burden lands squarely on human maintainers. Whether the benefit of clearing out stale code outweighs the cost of maintainer fatigue is the open question, and the answer likely depends on how the project shores up its development capacity.