Linux 7.3-rc3 exposes maintainer overload from AI-generated patches

September 13, 2026. Linus Torvalds releases Linux 7.3-rc3, a candidate he calls “another fairly large rc release”, with a heavier-than-usual filesystem footprint driven by XFS and the SMB client. Greg Kroah-Hartman. His warning, issued early in the cycle and repeated since, is about something else: AI-generated patches are overwhelming maintainers. Why it matters: AI is finding real bugs, but it is also clogging the queue of the people who have to review them.

What rc3 actually fixes

The third release candidate carries a bigger filesystem batch than expected at this stage of the cycle. XFS gets lock-annotation fixes and a health-monitor correction, carried largely by Darrick J. Wong (50 patches) and Christoph Hellwig (11 lock-annotation patches). The SMB client patches a heap overflow in DACL owner/group rewrites, rejects out-of-bounds data offsets, and repairs a WSL reparse-point corruption introduced since the 7.2 merge.

Memory-safety fixes, many flagged by the syzbot fuzzer, run through ppp_async, iommu/riscv, and the media tile-count validation. Landlock receives a use-after-free fix. Torvalds stresses the point he considers important: the bulk of the patch is still on the driver side, “mainly sound and networking drivers”, with GPU drivers staying modest.

The numbers give the scale. rc3 carries 513 distinct patches from 216 unique contributors, and the git window between rc2 and rc3 holds roughly 733 commits. At 7.3-rc1, the tree stood at 40.98 million lines, up from 40.42 million at the 7.2 baseline. The AMDGPU driver alone claims 6.52 million lines, about 16% of the kernel.

Greg Kroah-Hartman’s warning is not alarmism

Kroah-Hartman raised the alarm in early September after going through USB subsystem submissions for the cycle. His problem is not that AI patches are all bad: it is that he cannot efficiently separate them from genuine fixes. Reject too quickly and you risk missing a real bug. So maintainers do the work: read, test, respond. Multiplied across thousands of low-quality submissions, that is real engineering hours gone.

The networking subsystem has the clearest numbers. Jakub Kicinski, who maintains net and net-next with Paolo Abeni, estimates that between a third and half of the 648 net-next patches this cycle were “AI-driven low priority fixes, cleanups and clarifications”. His verdict is three words: “We are completely overwhelmed.” ARM64 development paid a direct cost — features that should have landed in 7.2 slipped because maintainers were consumed by noise. The 7.3 merge window closed as the second-largest in kernel history at 15,267 commits.

The CVE math is genuinely complicated

Here is the uncomfortable truth: AI is finding real bugs. The kernel is approaching 2,000 CVE fixes per release, up from roughly 500 through the 6.x era. The 7.2.3 point release alone shipped 71 security fixes, many flagged by automated AI tooling scanning more than 40 million lines of code. That is a safety improvement that was not happening before.

The cost is maintainer bandwidth. Reviewing thousands of CVE patches per cycle is not a human-scale problem. Andrew Morton, who runs the MM tree, recruited Google’s Gemini this cycle to draft his patch-series summaries after receiving 1,250 “added-to-MM” emails, up from 920 the prior cycle. His words: “I recruited Gemini to draft many of the bullets and then I did a review/edit pass. I think the result is better(?).” AI reviewing AI-generated patches.

The contribution policy is already cracking

The Linux kernel published its first formal AI contribution policy in April 2026: a human must sign the Developer Certificate of Origin, AI use must be declared with an “Assisted-by” tag, and the human submitter carries full legal accountability. It was the first major open-source governance document of its kind.

That policy is already under pressure. Christian Brauner argued in July that the tag had turned git history into “a free advertising platform for AI companies”. Jeff Layton proposed dropping it entirely, citing a low signal-to-noise ratio and uneven adoption. The debate is active and unresolved. Meanwhile, Meta is deploying AI to review incoming patches before they reach human maintainers: AI to filter AI, at scale.

What this means if you contribute

If you submit patches to the kernel, the current climate is unforgiving toward anything that looks AI-generated. Maintainers are pattern-matching on style, quality, and content faster than before. A low-quality patch is not just rejected: it costs the reviewer time they do not have. The formal requirement is the “Assisted-by” tag if you used AI tools. The practical requirement is that your patch be indisputably correct and worth a maintainer’s time to read.

Checking your own contribution chain takes a couple of commands:

# Verify a commit carries the Assisted-by tag if AI was used
git log -1 --format='%B' | grep -i 'assisted-by' || echo "no Assisted-by tag"

# Report the running kernel version
uname -r

The 7.3 stable release is still targeted for October 18, with a possible slip to October 25 if the patch rate does not ease. The kernel will ship. The real question is whether the community lands on a sustainable model for AI contributions before the next cycle — or whether 7.4 earns the same warning from Greg Kroah-Hartman.

Verdict

Linux 7.3-rc3 tells two stories at once: a kernel seriously hardening its filesystems and memory, and a maintainer community beginning to buckle under a flood of AI-generated patches. If you contribute to the kernel, be more rigorous than ever: a systematic “Assisted-by” tag and a provably correct patch. If you merely consume the kernel, the lesson is different: AI is raising the rate of CVE fixes, but the quality of what enters upstream still depends on humans with less time to review. Watch the 7.3 window in October, and the contribution policy being decided right now.

References

• Phoronix — Linux 7.3-rc3 Released: “Another Fairly Large RC”
• LWN — Linux 7.3-rc3
• Phoronix — Linux 7.3 “Rough Cycle” (Greg Kroah-Hartman’s warning)
• Tom’s Hardware — Linux Kernel Nears 2,000 CVEs Per Release as AI Bug Hunters Scour 40 Million Lines