By Linux 7.3-rc3 landed on September 13, and if you follow kernel development, the lead isn’t the XFS heap overflow fix or the Btrfs free-space cache promotion. It’s Greg Kroah-Hartman’s warning — issued early in the 7.3 cycle and reaffirmed with every subsequent rc — that AI-generated patches are turning this into a rough development window. “Rough” is his word, and he means it.
What rc3 Actually Fixes
The third release candidate carries a heavier filesystem footprint than you’d expect at this stage. XFS gets locking annotation fixes and a health monitor correction. The SMB client patches a heap overflow in DACL owner/group rewrites and rejects out-of-bounds data offsets — one of which introduced a WSL reparse point corruption lurking since the 7.2 merge. Memory safety fixes flagged by syzbot land across ppp_async, iommu/riscv, and media tile-count validation. Landlock security updates and architecture patches round out the release.
Torvalds described it as “another fairly large rc release” — unusual for an rc3, which in most cycles is where the patch rate starts to drop. It hasn’t dropped here.
Greg KH’s Warning Is Not Alarmism
Kroah-Hartman raised the alarm in early September after going through USB subsystem submissions for the cycle. His problem isn’t that AI patches are all bad — it’s that he can’t efficiently separate them from genuine fixes. Rejecting a patch too quickly risks missing a real bug. So maintainers do the work: read, test, respond. Multiplied across thousands of low-quality submissions, that’s real engineering hours gone. Phoronix documented the warning in detail.
The networking subsystem has the clearest numbers. Jakub Kicinski, who maintains net and net-next with Paolo Abeni, estimates that between a third and half of the 648 net-next patches this cycle were “AI-driven low priority fixes, cleanups and clarifications.” His assessment: “We are completely overwhelmed.” ARM64 development paid a direct cost — features that should have landed in 7.2 slipped because maintainers were consumed by noise. The 7.3 merge window closed as the second-largest in kernel history at 15,267 commits.
The CVE Math Is Genuinely Complicated
Here’s the uncomfortable truth: AI is finding real bugs. The kernel is approaching 2,000 CVE fixes per release, up from roughly 500 through the 6.x era. The 7.2.3 point release alone shipped 71 security fixes — many flagged by automated AI tooling scanning 40+ million lines of code. That’s a safety improvement that wasn’t happening before.
The cost is maintainer bandwidth. Reviewing thousands of CVE patches per cycle manually isn’t a human-scale problem. Andrew Morton, who manages the MM tree, turned to Google’s Gemini this cycle to draft his patch series summaries after receiving 1,250 “added-to-MM” emails — up from 920 the prior cycle. His words: “I recruited Gemini to draft many of the bullets and then I did a review/edit pass. I think the result is better(?).” AI reviewing AI-generated patches. Tom’s Hardware has the full CVE breakdown.
The Policy Has Already Started to Crack
The Linux kernel published its first formal AI contribution policy in April 2026: a human must sign the Developer Certificate of Origin, AI use must be declared with an “Assisted-by” tag, and the human submitter carries full legal accountability. It was the first major open-source governance document of its kind.
Assisted-by: Claude:claude-3-opus coccinelle sparseIt’s already under pressure. Christian Brauner argued in July that the tag turned git history into “a free advertising platform for AI companies.” Jeff Layton proposed dropping it entirely, citing low signal-to-noise ratio and uneven adoption. The debate is active and unresolved. Meanwhile, Meta is deploying AI to review incoming patches before they reach human maintainers — using AI to filter AI, at scale.
What This Means If You Contribute to Linux
If you submit patches to the kernel, the current climate is unforgiving for anything that looks AI-generated. Maintainers are pattern-matching on style, quality, and content faster than before. A low-quality patch doesn’t just get rejected — it costs the reviewer time they don’t have. The formal requirement is the “Assisted-by” tag if you used AI tools. The practical requirement is that your patch must be indisputably correct and worth a maintainer’s time to read.
Linux 7.3 stable is still on track for October 18, with a possible slip to October 25 if the patch rate doesn’t ease. The kernel will ship. The real question is whether the community lands on a sustainable model for AI contributions before the next cycle — or whether 7.4 gets the same warning from Greg KH. Based on LWN’s rc3 analysis, the answer is not obvious yet.
