Linux 7.1-rc4 Makes AI-Found Kernel Bugs Public

Linus Torvalds tagged Linux 7.1-rc4 on May 17, 2026, and used the weekly note to pull AI-found bugs off the private security list. Duplicate scanner reports had piled up there faster than anyone could close them.

The candidate itself looked ordinary. Drivers were about half the diff, GPUs led as usual, and the rest was networking, core code, filesystems, and architecture fixes. The line he wanted read was in the docs that landed in the same tree: if a model helped you find the bug, it is not a secret.

Torvalds Tagged 7.1-rc4 on a Sunday in May

The Linux 7.1-rc4 announcement on LKML opens the way these notes always do, with another week and another candidate. Then Torvalds called the week “fairly normal,” and immediately defined normal as a lot of changes.

He said people on the security list were spending their time forwarding mail or pointing at a public fix from a week or a month earlier. The duplication came from different people hitting the same code with the same tools, then filing in a channel where none of them could see the other filings.

AI detected bugs are pretty much by definition not secret, and treating them on some private list is a waste of time for everybody involved. If you found a bug using AI tools, the chances are somebody else found it too. If you actually want to add value, read the documentation, create a patch too, and add some real value on top of what the AI did. Don’t be the drive-by send a random report with no real understanding kind of person.

Linus Torvalds, Linux 7.1-rc4 announcement

He added that the written rules are less blunt than he is. The written rules still do the work the rant only names: they move a whole class of findings out of embargo because embargo was hiding the duplicates from each other.

Two to Three Reports a Week Before the Flood

Willy Tarreau, the HAProxy lead who also helps on kernel stable, put numbers on the queue in early April 2026, weeks before rc4. Two years earlier the private list saw 2 to 3 reports a week. Over the following year it rose to about 10 a week, and he called that wave AI slop.

From the start of 2026 the pace was 5 to 10 reports a day, with Fridays and Tuesdays the worst. Most of those later reports were correct, he said, enough that the team had to bring in more maintainers. Daily duplicate filings, the same bug from two people with slightly different tools, were new.

THE VOLUME ON THE PRIVATE LIST

• About 2024: Two to three security reports a week on the private list, per Tarreau.
• The year after: About ten a week, which he described as AI slop rather than a pile of real, new bugs.
• Early 2026: Five to ten reports a day, mostly correct, with duplicates arriving on the same day.
• The bind: A closed list cannot show reporter B that reporter A already filed the same crash.

That last point is the operational one. Volume hurts. Volume you cannot see is what turns triage into forwarding mail. A public thread at least lets the second finder search before they write.

Why AI-Found Kernel Bugs Are Treated as Public

Tarreau authored three documentation patches that sit in the 7.1-rc4 shortlog: do not systematically Cc the security team, spell out what is and is not a security bug, and set rules for AI-assisted reports. Jonathan Corbet added a link from that file to the threat-model document and tightened the wording on root capabilities.

The kernel’s treat an AI-found bug as public rule is the load-bearing sentence. The security team’s experience, the docs say, is that bugs found this way “systematically surface simultaneously across multiple researchers, often on the same day.”

The private list still exists. It is for urgent bugs that give an attacker a capability they should not have on a correctly configured production system, that are easy to exploit, and that threaten many users. The docs also say most mail to that list is a regular bug with the wrong label, sent by people who have not read the threat model.

Reporters who are unsure are told to err private. Ordinary bugs sent there do not move faster. They burn the same triage time the urgent ones need. For AI-assisted finds, the default flips the other way: treat them as public, and do not paste a working reproducer onto a public list. Say that one exists. Maintainers can ask for it in private if they need it.

The second effect is on credit and on embargo calendars. A finding that three other people can regenerate this afternoon is a poor fit for a multi-week quiet fix. The remaining scarce resource is a person who can turn the hit into a tested patch with a Fixes tag.

Length, Markdown, and Missing Reproducers

The AI section of the same file reads like a list of reports the team already had to throw away. Failure to meet it, the docs warn, “exposes your report to the risk of being ignored.”

THE FIVE AI REPORT RULES

• Length: Put a short summary and the critical details first; do not bury the file, version, and impact under pages of generated sections.
• Formatting: Convert the mail to plain text with no Markdown decorations, which break quoting and forwarding.
• Impact evaluation: Stick to a verifiable result, such as a user gaining a named capability, and skip invented chains of theoretical harm.
• Reproducer: Have the tool produce one, test it, and if it does not run, treat the report as suspect.
• Propose a fix: Ask the tool for a patch, test that too, and include a Fixes tag for the commit that introduced the bug.

The companion procedure for finding and fixing bugs is even more literal. Work on a current mainline tree and record the commit ID. Verify the bug. Write a fix in the same session. Build it without new warnings, pass checkpatch, and commit with an Assisted-by tag. The assistant must never send the mail itself. A human has to read the threat model and decide whether this is a vulnerability or a regular bug.

That is the bar Torvalds was pointing at. Use the tools. Do not stop at a paste of the model’s first draft.

Jose Fernandez’s AMD IOMMU Bounds Check

The same shortlog that carries the lecture also carries a one-line fix from Jose Fernandez, an engineer at Anthropic: bounds-check devid in __rlookup_amd_iommu().

The lookup indexed rlookup_table[devid] with no check of its own. A PCI device missing from the ACPI IVRS table could read past the end of the array. That used to return NULL on a zeroed page-order allocation. After the table became a tight kvcalloc(), the over-read could hand back adjacent slab contents and crash at boot. The commit message places the failure on Google Compute Engine VMs whose virtualized IVRS listed only a handful of endpoints, with a gVNIC sitting past the last described BDF.

Nothing in the changelog claims a model wrote that patch. What it shows is the path the new docs describe: a real crash, a tight check, a merge. The rc4 diff is otherwise the usual late-cycle mix, HID quirks, netfilter races, IOMMU reset paths, sched_ext fixes, nvme use-after-frees. Torvalds’s own non-tag patch in the week is a small ptrace cleanup around get_dumpable().

Drive-by reports fail that test. A bounds check that boots a VM passes it. The affiliation on the latter does not rewrite the former.

Process Documentation Outlived the 7.1 Branch

Linux 7.1-rc4 held 428 commits for the week. The cycle around it stayed on the usual Sunday cadence, then Torvalds tagged 7.1 on June 14, 2026, 28 days later, while travelling, at the regular hour in the local timezone.

LINUX 7.1 RELEASE CANDIDATES

Greg Kroah-Hartman marked the 7.1.y series end-of-life on September 2, 2026, with 7.1.13 as the last update on that branch. The public-by-default sentence did not go with it. It remains in the process documentation that later kernels still ship, along with the nine-step assistant checklist and the ban on models adding Signed-off-by tags.

The candidate is gone. The rule that an AI-found kernel bug is public, and that the useful follow-up is a tested patch, is what 7.1-rc4 actually left behind.

Frequently Asked Questions

What Qualifies as a Linux Kernel Security Bug?

The security list is for urgent bugs that grant an attacker a capability they are not supposed to have on a correctly configured production system, that can be easily exploited, and that represent an imminent threat to many users. Before filing there, the docs ask whether the issue actually crosses a trust boundary on such a system. Most mail the security team sees is a regular bug that should have gone through the normal reporting path instead.

What Four Facts Must Every Kernel Security Report Include?

Every security report needs an affected kernel version range with a stable identifier such as a commit ID or an exact kernel.org version, a detailed description of the problem, a reproducer that is not a binary-only executable, and the conditions that trigger it. A phrase such as “latest mainline” is rejected, and versions from distribution kernels are treated as meaningless to upstream maintainers. Binary-only exploits are not accepted as the reproducer.

Can an AI Assistant Add a Signed-off-by Tag?

No. Kernel documentation says AI agents must not add Signed-off-by tags, because only a human can legally certify the Developer Certificate of Origin. The human submitter reviews the code, adds their own Signed-off-by, and takes responsibility. The assistant’s credit, when tools contributed, is an Assisted-by tag in the form Assisted-by: LLM followed by optional analysis tools such as coccinelle or sparse.

Should AI-Found Reproducers Be Posted in Public?

No. Even though AI-assisted findings must be treated as public, the docs say not to share the reproducer on a public list, because that can cause unintended harm. The reporter should mention that a reproducer is available so maintainers can ask for it privately. Working exploits are treated as extremely helpful and are not released without the reporter’s consent unless they are already public.

Where Should a Report Go If the Maintainer List Is Unclear?

The preferred path is to run scripts/get_maintainer.pl on the affected file, send the report to those maintainers, and Cc the kernel security team, unless the issue is already public or trivial to rediscover. Only if that script still leaves the reporter stuck should the mail go to the security team alone. The team will triage it and may forward the message as-is.