> ## Content Index > Fetch the complete content index at: https://itsfoss.com/llms.txt > Use this file to discover other available public pages before exploring further. # Linux Kernel Bugs Hide for 2+ Years on Average - URL: https://itsfoss.com/news/linux-kernel-bugs-arent-found-for-years/ - Published: 2026-01-08T14:49:59.000Z - Updated: 2026-01-09T03:22:41.000Z - Description: Study of 20 years of kernel history finds bugs hide for 2+ years on average, some for decades. - Author: Sourav Rudra - Tags: News It was not too long ago we talked about [the first Rust CVE in the Linux kernel](https://itsfoss.com/news/first-linux-kernel-rust-cve/), which caused system crashes. That same day, 159 other CVEs were issued for C code. While that shows progress with Rust, it also highlights something more concerning; **the kernel has bugs that hide for years before anyone finds them**. A research blog published on [Pebblebed](https://pebblebed.com/blog/kernel-bugs?ref=itsfoss.com) demonstrates how bugs often stay hidden for years before they are discovered and fixed. 🚧 Please note that this study talks about bugs of all kinds. Not all bugs are vulnerabilities. ## The Linux Kernel Isn't Perfect ![this is a white colored chart that shows the distribution of bugs (using colored bars) on the linux kernel across 10+ years, you should OCR this to understand the stats](https://itsfoss.com/content/images/2026/01/linux-kernel-bug-lifetime-distribution-chart.png) **Source: Jenny Guanni Qu via Pebblebed* [Jenny Guanni Qu](https://github.com/quguanni?ref=itsfoss.com), a researcher at Pebblebed, **analyzed 125,183 bugs from 20 years of Linux kernel development history** (*on Git*). The findings show that the average bug takes 2.1 years to find. The longest-lived bug, a buffer overflow in networking code, **went unnoticed for 20.7 years**! The research was carried out by relying on the `Fixes:` tag that is used in kernel development. Basically, when a commit fixes a bug, it includes a tag pointing to the commit that introduced the bug. Jenny wrote a tool that extracted these tags from the kernel's git history going back to 2005\. The tool finds all fixing commits, extracts the referenced commit hash, pulls dates from both commits, and calculates the time frame. ![](https://itsfoss.com/content/images/2026/01/fixes-tag-usage-example.png) ![](https://itsfoss.com/content/images/2026/01/linux-kernel-bug-research-range.png) **Example of how the* *`Fixes:`* *tag is used on the left, the dataset parameters used by Jenny on the right.* As for the dataset, it includes over 125k records from [Linux 6.19-rc3](https://www.phoronix.com/news/Linux-6.19-rc3-Released?ref=itsfoss.com), covering bugs from April 2005 to January 2026\. Out of these, 119,449 were unique fixing commits from **9,159 different authors**, and only 158 bugs had [CVE](https://www.cve.org/?ref=itsfoss.com) IDs assigned. Plus, she found out that **different parts of the kernel show significant variation in how long bugs remain hidden**. [CAN bus](https://en.wikipedia.org/wiki/CAN%5Fbus?ref=itsfoss.com) drivers have the longest average at 4.2 years, followed by [SCTP](https://en.wikipedia.org/wiki/Stream%5FControl%5FTransmission%5FProtocol?ref=itsfoss.com) networking at 4.0 years. [GPU](https://itsfoss.com/news/arch-linux-old-nvidia-gpu-issue/) bugs get caught fastest at 1.4 years, and [BPF](https://en.wikipedia.org/wiki/Berkeley%5FPacket%5FFilter?ref=itsfoss.com) bugs are found within 1.1 years. The research also found that incomplete fixes are common. Someone notices undefined behavior and ships a fix, but the fix does not fully address the problem. In one case, a 2024 fix for *netfilter set field validation* was incomplete, and a security researcher found a bypass a year later. Jenny's research goes much deeper than what I covered here. She has also developed an AI model called **VulnBERT** that predicts whether a commit introduces a vulnerability. The detailed blog post linked above includes elaborate technical explanations on that; it is a must-read! --- **Suggested Read 📖:** [*The First Rust CVE in Linux Kernel*](https://itsfoss.com/news/first-linux-kernel-rust-cve/) [The First Rust CVE in Linux Kernel Only Makes Your System CrashGreg Kroah-Hartman announced this alongside 150+ C code vulnerabilities that were addressed.![](https://itsfoss.com/content/images/icon/android-chrome-512x512-200.png)It's FOSSSourav Rudra![](https://itsfoss.com/content/images/thumbnail/linux-kernel-first-rust-cve-1.png)](https://itsfoss.com/news/first-linux-kernel-rust-cve/)