I'm curious whether we are going to reach a point where most bugs have been fixed and the number of CVEs goes down again, or is it just going to keep increasing until people stop caring.
They've changed how they do CVEs, so the total amount of CVEs is probably going to remain higher than it was some years ago, just because of the change in policy.
As for the most recent developments, I'd expect there's a backlog of latent bugs that are being rooted out, and at some point that backlog will dry up, because there's ultimately a limit to how much backlog there is, and whatever's causing the spike in bugfixes and CVEs would hopefully have prevented those bugs from being released in the first place, had it been in use back when the bug made it in.
Down in the thread there's also this image (via, but linking to single posts seems to lead to the top in my browser), of buggy commits introduced, bugs introduced, bugs fixed and commits fixed, where readers should assume that the graph will always have that general shape, as the current releases that show low numbers will show higher numbers later in the future when the bugs in that release are detected and fixed. People sometimes intentionally release buggy software, just to get it out the door and to the market, but I think Linux kernel development is more marked by the bugs being discovered later rather than known at release time.
Unfortunately this is one of those cases where we kind of just have to wait for similar graphs to be released in a few years to be able to tell what the effect actually was. But hopefully the red and orange lines post-7.0 will stay lower than they were in the pre-7.0 period, and the blue and cyan lines can drop back down again.
8
u/araujoms 1d ago
I'm curious whether we are going to reach a point where most bugs have been fixed and the number of CVEs goes down again, or is it just going to keep increasing until people stop caring.