KERNEL BUGS HIDE FOR 2 YEARS ON AVERAGE. SOME HIDE FOR 20

Summary from the TLDR InfoSec newsletter

Analysis of 125,183 Linux kernel bugs with Fixes: tags revealed an average bug lifetime of 2.1 years, with race conditions averaging 5.1 years, and the longest-lived bug persisted for 20.7 years. Detection rates improved dramatically, from 0% bugs found within one year in 2010 to 69% in 2022, driven by tools such as Syzkaller and kernel sanitizers. The VulnBERT model achieved 92.2% recall and a 1.2% false-positive rate by combining CodeBERT embeddings with 51 handcrafted features targeting patterns such as unbalanced refcounts and missing NULL checks.