{"id":153453,"date":"2026-01-08T11:11:55","date_gmt":"2026-01-08T09:11:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/analiz-ispravleniya-oshibok-v-yadre-linux-v-srednem-oshibki-zamechayut-cherez-2-goda"},"modified":"2026-01-08T11:11:55","modified_gmt":"2026-01-08T09:11:56","slug":"analiz-ispravleniya-oshibok-v-yadre-linux-v-srednem-oshibki-zamechayut-cherez-2-goda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/analiz-ispravleniya-oshibok-v-yadre-linux-v-srednem-oshibki-zamechayut-cherez-2-goda","title":{"rendered":"Analysis of bug fixes in the Linux kernel \u2014 on average, bugs are noticed after 2 years.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The results of the study on the time taken to detect and fix errors in the Linux kernel have been published. The data was obtained from the analysis of 125,000 errors marked in the Git repository with the tag «Fixes:», referring to the commit where the error originated. The average detection time for kernel errors was 2.1 years. When considering only errors fixed in 2025, this figure rose to 2.8 years. <\/p>\n
30% of errors were fixed by the same developers who introduced them. 56.9% of errors are resolved within a year. 13.5% of errors went unnoticed for more than 5 years (for those fixed in 2025, this figure was 19.4%). Due to uneven distribution, the median age of an error in the kernel code was 8 months for the sample from 2005 and 1 year for errors fixed in 2025. The longest standing error in the code was a buffer overflow in ethtool, which was resolved after 20.7 years.
<\/center> <\/p>\n
The dynamics of error detection varies significantly from the average for some subsystems, for instance, in the CAN bus driver and the SCTP stack, the average issue detection takes about 4 years; in the IPv4 stack \u2014 3.6 years, USB and TTY \u2014 3.5 years, Netfilter and the network stack \u2014 2.9 years, VM \u2014 1.8 years, GPU \u2014 1.4 years, and BPF \u2014 1.1 years.
<\/center> <\/p>\n
Detection time correlates with the types of errors: the average detection time for race condition errors was 5.1 years, for integer overflow \u2014 3.9 years, for use-after-free \u2014 3.2 years, for buffer overflow and memory leak \u2014 3.1 years, for reference counting \u2014 2.8 years, for null pointer dereference and deadlocks \u2014 2.2 years. <\/p>\n
The obtained statistics also reflect the impact of introducing new tools for automated error detection, static analysis, and code testing, such as Syzkaller, KASAN, KMSAN, and KCSAN. For instance, in 2010, no bug fixes were recorded within the year. In contrast, in 2014, 31% of errors were identified within a year, in 2018 \u2014 54%, and in 2022 \u2014 69% of errors. <\/p>\n
The obtained statistics were used to create the VulnBERT machine learning model, which predicts the presence of vulnerabilities in commits. When tested on commits from 2024, the error detection accuracy was 92.2% with a false positive rate of 1.2% (for comparison, the previously available CodeBERT model identified 89.2% of issues with a false positive rate of 48.1%). \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Analysis](\"\/wp-content\/uploads\/2026\/01\/18910bd9fa4c34878e303160eb662f2a.png\")
<\/center> <\/p>\n![\"Analysis](\"\/wp-content\/uploads\/2026\/01\/d1059c4d97733e42698d5252931431d7.png\")
<\/center> <\/p>\n