Inside the stable kernel

Why this conversation

The stable kernel is the Linux most servers actually run, so the way it is maintained is a question for anyone who runs systems. Greg Kroah-Hartman maintains the stable kernel trees and parts of the driver core, works on the kernel security team, and works with the EU on the Cyber Resilience Act and other legal questions. He met the show by the badge desk on the Wednesday morning of Open Source Summit Europe in Prague, the same morning the State of Open Source in Europe report he wrote the foreword of was launched in the keynotes. The story of that week is in Open Source Summit Europe 2026: who we met.

Bugs found by machines

Asked what he is working on, Greg calls it boring. AI and fuzzy pattern-matching tools have found bugs in the kernel’s code, and the developers are grinding through them and fixing them. “It’s not interesting, it’s important, but it’s just a lot of work,” he says. Some are zero-days, but most are small bugs all along the way.

The tools work much like other scanners. The simplest use is to show them all the bugs fixed in the past and ask where the same mistakes are still in the code today. The kernel community, he points out, has used the ideas behind these tools for decades: there are papers on it, and similar techniques have helped pick backports for the stable kernels for ten or fifteen years. Every change submitted to the kernel now also goes through a public bot that runs a checklist and reports what looks wrong, as a first step of code review. It found problems in patches Greg submitted himself a week or so before. Rust, he adds, is a separate subject, independent of AI and LLMs.

From servers to phones to RISC-V

The kernel is 25 to 30 million lines of code, but no machine runs all of it. “Servers are very simple machines,” Greg says: a disk and a network, two to three million lines. A laptop runs three to four million. Phones are the most complex, at four to five million, because of all the chips, sensors, graphics and connections. The AI models a server loads at runtime are user space; the kernel’s job is to abstract the hardware, fix its bugs and provide that middle layer securely, so the same program works on a server, a Raspberry Pi or an Android device.

That abstraction is why he has hope for RISC-V. A RISC-V company can make a good chip and compete on equal ground, because everything that works on Linux works on it. The ecosystem has had growing pains getting chips to work properly, but there is now a standard, and people email him unusual CPU designs every month. The kernel developers do not work with manufacturers directly, but they talk to them all the time: Intel and AMD for decades, ARM, Qualcomm, Huawei. Design cycles are long, four to six years, so a complaint today may show up in about five.

The EU, sovereignty and the CRA

Greg is positive about the Cyber Resilience Act. The EU wants software and devices to be secure, and the CRA works like an ingredients list for the software in a device, as for food or paint, kept up to date for known vulnerabilities for a number of years. The commissioners know open source is important, the requirements on open source communities are minimal, and the law makes the companies that ship open source send bug reports back, which they have not always done.

On digital sovereignty, his point is that Linux lets you run your own systems without depending on another company. Kernel people work with governments, the German government among them, to show them how. Nobody is forced to use Linux, but anyone who wants to can own their systems.

Students and the long haul

For someone entering the job market, Greg’s selfish answer is that there is plenty of kernel work, especially in security. He works with universities, including one in Amsterdam, and this summer gave master’s students security bugs that AI had found to research. His advice to students is to use their free time to contribute to open source. University teaches you to solve problems on your own; real work means changing an existing code base with other people, and an open source track record shows an employer you can do that. Google Summer of Code, which the kernel has taken part in since the beginning, outreach programmes and the Linux Foundation’s internship programme are ways in. One speaker at the event started as an intern.

Maintaining, he says, is the different skill. Writing a project once is simple; evolving it for 35 years with about 5,000 developers from 600 companies is not. The kernel splits responsibility among some 700 maintainers, and everything is merged and tested together every day. Because the kernel hits these pain points early, its developers help other projects, such as Kubernetes when it was scaling. Linux has no plan beyond working for everyone: it iterates on what people send. His favourite part of the job is finding Linux where he did not expect it: in his washing machine, in satellites, on Mars.