Torvalds joked that AI made Linux 7.3-rc2 this big, and nobody checked

Linus Torvalds spent Sunday afternoon doing what he does most Sundays. The result was a Linux 7.3-rc2 that came in far heavier than the calendar says it should. He could not find a single cause for it. So he offered the one everybody reaches for.

“It might be just random,” he wrote in his rc2 announcement. “But we’ll obviously all blame it on AI, because whether that’s really the cause or not, it’s an easy thing to blame.” He closed the sentence with a winking emoticon. Earlier in the same post he called the release a “full fat” one. That is not how a second release candidate is supposed to read.

The shortlog attached to that announcement carries 615 commits from 292 contributors, by TNW’s count. Torvalds did not publish a figure himself. Nor did he offer a diagnosis. He noted only that “nothing looks particularly odd”. The joke arrives in place of an explanation, which is what makes it interesting.

What is actually inside Linux 7.3-rc2

An rc2 is normally the quiet week. The merge window has shut, everyone breathes out, and the bug reports have not started landing yet. This one behaved like a merge window that refused to end. Several filesystems sent fixes. The graphics tree sent a sizeable pull of scattered ones. Networking, bpf and a run of driver trees all filed too.

Torvalds pointed at a late EDAC pull that missed the merge window, then dismissed it himself as a small thing. A week earlier he had blamed the size of rc1 on an AMD GPU register dump, and on himself. He called himself “a grade A nincompoop” in the rc1 post for running a system upgrade mid-window. Neither explanation stretches to cover rc2.

The most useful line in the whole post has travelled least. Tooling accounts for roughly 20% of the entire patch, mostly sched_ext and selftests. Drivers always dominate a kernel release. Outside them, tooling is now the biggest source of change, ahead of filesystems, core kernel and networking. That is test infrastructure growing, not features.

Torvalds answered this question seriously a month ago

The joke reads differently next to what he wrote on 9 August. Announcing 7.2-rc7, he said he was not thrilled about the size of it. Then he gave a straight causal account. This is the new normal, he wrote, with a lot of fixes, many of them the product of review by various AI tools. No emoticon that time.

The Register reported the rc2 line on Monday. Its APAC editor, Simon Sharwood, has tracked these Sunday posts through the whole cycle. The August statement is the one that matters more, because it draws a distinction the September joke collapses.

Machines reviewing code and flagging bugs is not the same thing as machines writing code. The first produces a flood of small, scattered fixes and a lot of new tests. That is what rc2 looks like. The second produces a failure mode TNW has covered repeatedly, where generated code fails security tests at rates its authors did not expect.

The kernel already built the instrument to settle this

Here is the part nobody is using. The kernel documents an AI Coding Assistants policy. It asks contributors to declare machine assistance with an Assisted-by: LLM trailer in the commit message. AI agents must not add a Signed-off-by line, because only a human can certify the Developer Certificate of Origin. The tag is a field in the git history, which means it is countable.

A companion document on tool-generated content sets out why the project bothers. Tools increase the volume of contributions, it says, while reviewer and maintainer bandwidth stays a scarce resource. Knowing which parts came from a human and which from a tool is how the project protects that resource.

So the question Torvalds waved away is answerable in principle. Somebody could count the Assisted-by trailers in rc2 and publish the number. Nobody has. The count would also undershoot. The tags are voluntary, the guidelines exempt trivial tool use, and a maintainer who cleans up a generated patch by hand need not say so.

The kernel is not relaxed about this, whatever the tone suggests

Read the guidance again and it is noticeably wary. Maintainers may treat a tool-assisted series like any other contribution. They may also demand extra testing, review it at lower priority, or reject it outright without detailed review. Contributors should expect scrutiny in proportion to how much of the work a tool produced. That is a project bracing for volume, not welcoming it.

Other communities are landing in different places. In August, The Register reported that Debian voted to permit AI-assisted contributions, with disclosure optional and quality mandatory. That is close to the opposite of the kernel’s bet on declared provenance. Both projects are guessing. Neither has the evidence yet.

The evidence that does exist is not comforting. Research suggests the tools can slow developers down while convincing them of the opposite. In one case a model wrote every control a security review asked for, and still missed the question underneath. Startups have built businesses on the gap. Aikido bought Root to patch open source automatically.

Open source infrastructure is a soft target when nobody is sure what landed. Attackers hijacked more than 1,500 Arch Linux packages in June to steal developer secrets. No exploit was involved at all. Provenance is not a bureaucratic concern in this ecosystem. It is the control.

What to watch next Sunday

Linux 7.3-rc3 lands in a week, and the pattern will either hold or break. Suppose rc3 is heavy again, and heavy in the same places: tooling, tests and scattered small fixes. Then Torvalds’ August account is the real one, and his September joke was a joke about a fact. If rc3 collapses back to normal, the size of rc2 was noise.

Either way, the kernel has a tag that could turn the shrug into a number. It will keep working only if people use it. Blaming AI is free. Counting it is not.