Kernel prepatch 7.1-rc4 [LWN.net]

The 7.1-rc4 kernel prepatch is out for testing.

Some of the documentation updates might be worth highlighting: the continued flood of AI reports has basically made the security list almost entirely unmanageable, with enormous duplication due to different people finding the same things with the same tools. People spend all their time just forwarding things to the right people or saying "that was already fixed a week/month ago" and pointing to the public discussion.
Which is all entirely pointless churn, and we're making it clear that AI detected bugs are pretty much by definition not secret, and treating them on some private list is a waste of time for everybody involved - and only makes that duplication worse because the reporters can't even see each other's reports.

(He is referring to this pull request with patches from Willy Tarreau defining what constitutes a security bug and responsible ways to use AI to find bugs).

to post comments

Excellent communication

Posted May 20, 2026 3:18 UTC (Wed) by wtarreau (subscriber, #51152) [Link]

It was a great idea from Linus to explain this in such a visible message as an -rc announce, because it's currently being relayed everywhere with sensationalism so the message is spreading. Hopefully within a few days to weeks the situation will improve. Over the last week I would say that between 1/3 to 1/2 of incoming messages had maintainers in Cc, maybe 1/5 had a patch, but still almost never in an exploitable format, wasting maintainers time. That might be the next point to try to address better by using bold in the doc if nothing changes... Let's wait a bit and see.

On the bright side, there are a few (so rare that we thank them) who send excellent reports starting with "I read the doc, I hope that I did it right", which makes me think the elements are there if people are willing to spend 5mn reading (or ask their LLM to read for them).

I also got private reports of some maintainers being stressed by some reports addressed to them directly. This reinforces my feeling that we need to add a section in the doc to remind maintainers that they can seek help from the security team, they should not stay alone dealing with bugs, that's the best way to speculate on theoretical impacts and increase the stress level. That's particularly true with AI-generated reports which are often very alarming, though some reporters are pretty good at this as well.