Linux 内核安全漏洞泛增与 AI 生成风险
问题概述
The Linux kernel is experiencing an unprecedented surge in reported CVEs, and commenters note that AI‑assisted development is likely to further accelerate vulnerability volume, while human review capacity struggles to keep pace.
痛点标签
- 大量 CVE 编号导致安全漏洞数量膨胀，难以追踪
- AI 辅助代码生成导致新安全漏洞快速增加
- 人工审查资源有限，难以匹配代码规模和漏洞发现需求
待验证问题
- 这些 CVE 的实际利用风险有多大？
- AI 生成代码在实际项目中是否已经导致可利用的漏洞？
- 当前的审计和补丁流程能否跟上漏洞增长的速度？
证据
原话
I head a much, much smaller open source project. Since the November Singularity we've been seeing at least six responsibly reported security advisories a month. However, this last month we had 22 unique security advisories. Our project has been built with adherence to the OWASP Top Ten Guidelines and other best practices from the beginning. But software is hard and AI is thorough.Each month, we fix them all in our monthly maintenance release and disclose at that time. We fight AI fire with fire, and hand-review, of course.So far, we can keep up. One hopes this is possible at the scale of the Linux project, which assuredly has more humans and more AI to throw at the problem. But team size does not scale linearly with interested audience, and potential bugs do scale with codebase size (and o
原话
note that _any_ bugfix is assigned a cve, which makes for big numbers.>"Due to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel… Because of this, the CVE assignment team is overly cautious and assign CVE numbers to any bugfix that they identify."
免责声明：本卡片由 AI 从社区讨论中提炼，属于「痛点证据」，是需求分析与验证的起点，不等同于「已验证的市场需求」。AI 存在分析局限，关键决策前请打开上方原始讨论人工复核。