There Are Kernel Bugs in Your System That Won’t Be Found for 20 Years

The analysis of Linux kernel bugs shows that some bugs remain undiscovered for over 20 years, with an average lifespan of 2.1 years. The study examined 125,183 bug-fix pairs and found that certain subsystems have longer bug lifetimes. A tool developed for the research identified 92% of historical bugs, and findings indicate that bug discovery has improved over time.

Kernel bugs in the Linux kernel often persist far longer than many developers expect. A recent study analyzing 125,183 bug-fix pairs across 20 years of Linux kernel git history found that bugs remain undiscovered for an average of 2.1 years. While many issues are detected relatively quickly, a significant long tail remains, with some bugs surviving for more than 20 years before being fixed.

The analysis shows wide variation across subsystems. CAN bus drivers and SCTP networking exhibit some of the longest average bug lifetimes, at 4.2 and 4.0 years respectively. Networking-related code in general tends to harbor bugs longer than other areas, while GPU and BPF subsystems see much faster detection. The longest-lived bug identified in the dataset was a buffer overflow in ethtool that remained in the kernel for 20.7 years.

Bug detection has improved over time, but unevenly. In 2010, none of the bugs introduced that year were found within a year of introduction. By 2022, 69% of new bugs were identified within their first year. This improvement aligns with the broader adoption of kernel fuzzing, sanitizers, and more rigorous review processes. However, the study cautions that recent data is partially right-censored, meaning newer bugs have not yet had time to exhibit long lifetimes.

The research also highlights a persistent backlog of long-lived bugs. Among bugs fixed in 2024 and 2025, 60% were introduced within the previous two years, but 18% dated back five to ten years, and 6.5% were more than a decade old. This indicates that while new bugs are being caught faster, older issues continue to surface slowly.

Certain bug types are especially difficult to uncover. Race conditions had the longest average lifetime at 5.1 years, followed by integer overflows and use-after-free errors. These bugs are often nondeterministic or require specific timing, memory pressure, or workload conditions, making them hard to reproduce through convenutional testing.

To address these challenges, the researchers developed VulnBERT, a machine learning–based system designed to identify bug-introducing commits at commit time. VulnBERT combines neural code embeddings with handcrafted, domain-specific features and achieved a recall of 92.2% on a held-out 2024 test set, with a false positive rate of 1.2% and an F1 score of 95.4%. The approach aims to reduce the time bugs remain in production by flagging high-risk commits before they are merged.

The findings suggest that Linux kernel reliability has improved, but not uniformly. Faster detection of new bugs coexists with a substantial backlog of long-lived issues, particularly in complex and less frequently exercised subsystems. The study concludes that automated analysis tools, combined with fuzzing and human review, are increasingly necessary to reduce the window in which kernel bugs can affect systems at scale.

• https://pebblebed.com/blog/kernel-bugs...