Seven kernel LTS releases drop with USB/IPsec fixes and AI in the commit log

Greg Kroah-Hartman pushed seven stable kernel releases this week: 5.10.269 through 7.1.13 across every active LTS and maintenance branch. The security content is consistent across all of them: use-after-free in the USB subsystem and out-of-bounds writes in the IPsec networking stack, backported from mainline.

Both classes of bug process external input. USB devices you did not choose. IPsec packets from peers you might not trust. If you are running any of these trees, the update is not optional.

The other thing in these commits

Several patches in this batch carry “Assisted-by:” metadata. That is a new commit tag format the project introduced to credit AI models for their role in identifying upstream bugs. GKH runs his own local LLM, something he has named gkh_clanker_t1000, on his own hardware. Locally. Not in the cloud, not piping 40 million lines of kernel source to a third-party API. He told The Register in March that AI-generated bug reports have gotten substantially better, and that they “aren’t slop anymore.”

I have been sitting on an opinion about this for a while.

Fine. Here it is.

I was skeptical. Kernel code is not the kind of thing where plausible-looking output is good enough. A convincing wrong patch is worse than an obviously wrong one because it gets past review. The stakes are kernel panics, silent data corruption, and security regressions that don’t show up for months.

That skepticism was about autonomy, not detection. And those are different things.

Static analysis tools have been hunting kernel bugs for twenty years. sparse catches type system violations. smatch finds uninitialized reads and integer overflows. coccinelle matches semantic patterns across the whole tree and generates patches. Nobody declared coccinelle a threat to kernel integrity. It found bugs humans missed, humans reviewed the output, and humans merged the good fixes.

“Assisted-by:” is the same model. The tool flags something suspicious. GKH reads the code, decides whether the flag is right, and either merges or drops it. His name goes on the commit. His judgment is still the gate. The “Assisted-by:” line is honest attribution, not a handoff of responsibility.

The bit that matters here is the “locally.” GKH is not sending kernel source to someone else’s inference cluster. The model runs on his machine. That is the correct operational security posture for a project where supply chain trust is already a hard enough problem as it is. See the xz backdoor supply chain scorecard from last Friday if you need a refresher on why.

If a model doing continuous review of 40 million lines catches a use-after-free that smatch missed, the right response is to fix the bug, credit the tool that found it, and ship the patch. The kernel has bigger problems than tool attribution politics.

That earned reversal took about eight months of watching real bugs get caught and real patches get merged. I do not hand those out for free.

What this means for your stable branch

The USB and IPsec fixes are the reason to update today. The “Assisted-by:” question is interesting for what it says about where kernel development is going, but it does not change the update math.

If you are on a downstream distro, check whether your vendor has pulled from GKH’s stable tags or whether they are managing their own backport queue. Distro kernel divergence is where this kind of fix gets quietly missed. The Linux 7.3 merge window coverage from earlier this week has the upstream timeline if you are tracking what is coming in the next cycle.

For the tooling side of kernel analysis, the sched-ext and BPF scheduler post from last week covers the human-operated end of that spectrum. Brendan Gregg’s BPF Performance Tools belongs on your shelf for the parts where you still have to figure it out yourself.

Update your trees.