Amazon Web Services engineers have outlined a mixed human-and-machine process for triaging Linux kernel CVEs in the kernels that power EC2 infrastructure, using an automated filter first and then an AI agent to classify what remains before human review. The company says the system cuts down the volume of issues dramatically, but it still keeps engineers in the loop for the final security decision.
AWS uses AI agents as a classifier, not a decision-maker
The work was presented by Dylan Johnson and Justinien Bouron at the Linux Plumbers Conference in Prague earlier this month. Johnson explained that the team maintains the kernel used within EC2 infrastructure, which is separate from Amazon Linux and from the kernels customers run inside their own virtual machines.
According to the talk, AWS’s approach starts with a non-AI filter. Kernel CVE records are published in JSON and include affected versions and source files. A script drops a CVE if the kernel version is outside the affected range, or if none of the listed files are built into the image. Bouron said this removes about 70% of CVEs in AWS’s environment, though the exact figure depends on kernel configuration.
The remaining CVEs are sent to an AI agent, which receives the AWS kernel source tree, platform-specific configuration, an environment description, a threat model and a severity rubric. The agent returns a table identifying the affected subsystem, vulnerability type and attack vector. Johnson described the agent as “a very fancy classifier,” and the team said it ignores CVSS scores because they are not specific enough to its environment.
Human review remains the final check
Two engineers usually review the table produced by the agent. The slides show the system takes about 3.4 seconds per CVE, compared with minutes for a person. Bouron said that review is now the slowest step in the process, but also made clear that AWS does not want to remove it.
“We don’t want to hinge our entire security posture on the output of an LLM agent,” Bouron said.
When asked about accuracy, Bouron estimated that between 5% and 10% of the agent’s decisions were problematic, though he described that as an informal estimate rather than the result of a formal evaluation.
Why the Linux kernel CVE volume changed so sharply
Johnson and Bouron said the team saw a major increase in published kernel CVEs after the Linux kernel project became a CVE Numbering Authority in February 2024. Before that, the team had seen about two kernel CVEs a week; afterward, the rate increased to about 16 a day. By 15 August 2026, 848 had been published in a single day, according to the presentation.
The Linux kernel documentation notes that the project cannot know how any given system uses the kernel, so users must decide which CVEs apply to them. For AWS, that means triaging against the exact build and configuration used in EC2 rather than relying on broad vulnerability notices.
- Before February 2024: about two kernel CVEs a week
- After February 2024: about 16 kernel CVEs a day
- Published on 15 August 2026: 848 CVEs
Reducing exposure by trimming kernel features
AWS also reduces the number of applicable CVEs by disabling kernel features it does not need. Bouron called that effort “deceptively difficult.” The slides cited more than 32,000 configuration options, and removing the wrong one can create bugs or performance regressions that may not appear for months.
The team also has to watch for dependency chains when backporting fixes. Bouron noted that CVE records often name only the final fixing commit, so a team that misses prerequisite commits may still be vulnerable even after applying the listed fix.
Older LTS branches carry more unfixed issues
The presentation argued that AWS needs to move to newer long-term-support kernels faster because older branches accumulate fixes that never get backported. For CVEs affecting all six branches studied, the median time from a mainline fix to an LTS release was 31.8 days for Linux 5.10 and 18.1 days for 6.18.
On 16 September, the team counted 1,709 known unfixed CVEs in 5.10, compared with 229 in 6.18. AWS emphasized that these figures are per branch and do not show how many affect its own kernel, but they illustrate the maintenance burden that older LTS lines can create.
The company also said its upgrade cadence has improved. Johnson said the move from 4.19 to 5.10 took about two years from the start of porting work to full production deployment. The next upgrade took about a year, and the move to 6.18 took about six months.
- 4.19 to 5.10: about two years
- Next upgrade: about one year
- Move to 6.18: about six months
During the 5.10-to-6.12 upgrade, 43% of tracked issues were fixed in userspace because workloads depended on older kernel behavior. Johnson said AWS will now run stable kernels in testing through the year and move the fleet when each new LTS release appears.
How AWS’s approach compares with other cloud teams
AWS was not the only cloud provider discussing this problem at the conference. Microsoft’s Azure Linux team described a similar pipeline, though its triage verdicts come from a rule table and AI is used only to suggest inputs. That team also uses agents for backporting and said a build-and-test feedback loop lifted its success rate from about 50% to 80%.
Google DeepMind’s CodeMender, which InfoQ covered in October 2025, takes a different angle by focusing on writing fixes. Its announcement said human researchers review every patch before it is submitted upstream.
What AWS says it may share
AWS has not released the tools it uses internally. Asked about open-sourcing them, Johnson said the team would like to explore sharing the filtering tool. He also noted that AWS’s internal environment makes it easier to disable features than would be the case for a general-purpose Linux distribution.
For now, the company’s message is that AI can speed up CVE triage, but not replace expert judgment. In AWS’s workflow, the agent saves time by sorting and classifying vulnerabilities, while engineers still make the final call on what matters for their infrastructure.
Source: InfoQ, “AWS Shows Use of AI Agents to Triage Linux Kernel CVEs,” by Matt Saunders, Oct. 27, 2026.
Source: Original report
Was this helpful?
Explore more: Application Audit & Review More Cybersecurity Tech News
Last Modified: October 29, 2026 at 10:33 pm
2 views
