Linux Kernel 7.2.x Update: 7.2.3 Drops with Security Hardening and a Notable AI-Assisted Patch Trend
Greg Kroah-Hartman shipped Linux 7.2.3 today, packing roughly 71 backported fixes across USB, networking, crypto, and audio subsystems. It's a substantial stable release, but if you've been tracking the 7.2.x branch since late August, the real headline isn't just the patch count. It's the Assisted-by: tags multiplying in the commit messages.
The 7.2 feature release landed on August 16, and Linus Torvalds didn't sugarcoat the final merge window. "This last week of the release was once again bigger than I would have wished for," Torvalds wrote, adding that he's already sitting on 40 pending pull requests for 7.3. The release itself brought cache-aware scheduling for Intel's multi-die chips, a new USB4STREAM protocol for display pipelines, FRL support in the AMDGPU driver, and some welcome I/O scheduler tweaks. The DRM fair scheduler, though, got a quick slap on the wrist. It was reclassified as experimental after enough regressions piled up to pull it from the default build.
Head here to the official 7.2.3 changelog if you want to scan the full diff, but the security surface being patched is fairly broad. Bluetooth continues to be a recurring theme, with length validation overflows, uninitialized stack leaks in ISO sockets, and use-after-free bugs in the suspend and reset paths all getting cleaned up. Networking took similar hits. An IPv4/IPv6 fragment panic triggered by a single tun/tap write got neutered, the netfilter packet path list race was sealed, and a VXLAN FDB flush that could trip over an invalid RCU pointer finally got proper bounds checking.
Memory management got a quick security win too. swapon() on encrypted ext4 and f2fs files is now blocked, since letting users flip on encrypted swap was essentially just leaving password material sitting in plaintext on disk. KVM/s390 zeroes out stale crypto bits in shadowed control registers, closing a small but real nested virtualization isolation gap.
Keep in mind that the crypto subsystem overhaul in 7.2.3 quietly removes AES-ECB, DES, and 3DES from the Qualcomm crypto engine. The commit notes that AES-ECB reveals plaintext patterns, and stripping out those legacy algorithms is exactly the kind of hardening that slips under the radar until someone benchmarks it. Kerberos key buffers now use kfree_sensitive(), and the virtio backend enforces strict result length bounds to stop out-of-bounds kernel heap reads.
The AI Flood in the Staging Tree
The real head-scratcher in 7.2.3 is the explicit credit line for machine learning tools. Commit messages now regularly note Assisted-by: Claude:claude-opus-5, Codex:gpt-5.6-sol, and what looks like Greg's own internal assistant, gkh_clanker_t1000. TencentOS's Corvus AI reported a race condition in the netfilter packet path, while OpenAI's Kyle Zeng co-developed the VXLAN and batman-adv boundary checks. Anthropic researchers independently patched a hyperv HID DoS and a KVM vmclock memory corruption back in 7.2.1, and syzbot continues to flag futex edge cases that Peter Zijlstra promptly addressed.
It's not just cosmetic either. Greg has been outright rejecting LLM-generated patches for the staging tree, drawing a hard line except for genuine security findings. Networking maintainers report being completely overwhelmed by AI-spun churn during the 7.3 merge window, and CVE counts are creeping toward 2,000 per release. Roughly four times the historical average. Not all of those are new bugs. Many are just LLMs triaging known issues that slip through the cracks, though the volume alone forces a tighter review process.
Linus himself admitted to using AI to debug an Intel Xe graphics bug he called a debug session from hell, noting the tool enormously helped find the actual fault. However, at the same time, the kernel community remains split on how far to lean into automated patch generation. The staging tree draws the line at genuine security fixes. Beyond that, it's a manual review war.
The maintainer lineup is shifting alongside the tooling. Wolfram Sang handed the I2C subsystem to Andi Shyti after 13.5 years, and Steve French stepped down as CIFS/SMB3 maintainer for health reasons, effective in the 7.3 cycle. If you're running a workstation or a server, the 7.2.3 stable tree is the right place to land. It's the patched, hardened version of 7.2 you want on production hardware right now.
Linux kernel 7.2.3 released
Linux kernel version 7.2.3 is now available:
Full source: https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.3.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v7.x/patch-7.2.3.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.3.tar.sign
You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v7.2.3/v7.2.2
