Beyond Crash-to-Patch: Patch Evolution for Linux Kernel Repair

Abstract: Linux kernel bug repair is typically approached as a direct mapping from crash reports to code patches. In practice, however, kernel fixes undergo iterative revision on mailing lists before acceptance, with reviewer feedback shaping correctness, concurrency handling, and API compliance. This iterative refinement process encodes valuable repair knowledge that existing automated approaches overlook. We present a large-scale study of kernel patch evolution, reconstructing 6946 syzbot-linked bug-fix lifecycles that connect crash reports, reproducers, mailing-list discussions, revision histories, and merged fixes. Our analysis confirms that accepted repairs are frequently non-local and governed by reviewer-enforced constraints not present in bug reports. Building on these insights, we develop PatchAdvisor, a repair framework that integrates retrieval-based memory with a fine-tuned diagnostic advisor to guide a coding agent toward reviewer-aligned patches. Evaluation on temporally held-out syzbot cases demonstrates that leveraging patch-evolution history yields measurable gains in both reviewer-aligned refinement signals and end-to-end repair quality compared to unguided and retrieval-only baselines.

• The paper shows that Linux kernel repairs evolve through iterative revisions and reviewer feedback, with only 3.1% of fixes near the crash site.
• The paper introduces PatchAdvisor, a framework combining memory retrieval and a fine-tuned advisor, achieving a DCR of 0.88 and improved code generation quality.
• The paper demonstrates that integrating patch evolution history and review constraints results in more robust and merge-worthy fixes for kernel bugs.

Patch Evolution for Linux Kernel Repair: A Syzbot-Grounded Study and PatchAdvisor Framework

Introduction

The paper "Beyond Crash-to-Patch: Patch Evolution for Linux Kernel Repair" (2604.03851) presents an empirical analysis and a new framework for automated repair of Linux kernel bugs, centered on the iterative nature of patch acceptance in kernel development. Unlike conventional automated program repair (APR) approaches that map crash reports directly to code patches, this study emphasizes the crucial role of revision history, reviewer feedback, and subsystem-specific constraints that govern final patch acceptance.

Dataset Construction and Patch Evolution Reconstruction

The research leverages syzbot, Google's continuous fuzzing infrastructure for kernel bugs, constructing a multi-stage pipeline to integrate crash evidence, reproducer artifacts, patch discussion threads, patch revision histories, and merged fixes. The resulting dataset covers 6,946 fixed bugs, with 5,043 merged diffs and extensive mailing list discussions (~5,000 threads).

Figure 1: End-to-end pipeline for building PatchAdvisor: connecting bug reports, revision histories, review threads, and merged fixes to drive repair guidance.

The pipeline collects artifacts across syzbot, git.kernel.org, lore.kernel.org, and patchwork.kernel.org, normalizing disparate sources and reconstructing chains of proposal, critique, revision, and acceptance for each bug. This dataset enables fine-grained empirical analysis and serves as supervision for learning-based repair guidance.

Empirical Findings: Dynamics of Kernel Patch Evolution

Analysis of patch evolution reveals several recurrent phenomena:

• Non-locality of Repairs: Only 3.1% of fixes are located in the same function as the crash site; 77.5% are file-local, but 3.7% require subsystem-crossing changes. The stack trace is an unreliable indicator of true fix location.
• Iterative Revision Process: 1,099 bugs underwent multi-version patch series; 78.3% of inter-version transitions contained substantive reviewer feedback. Revision is a socially guided process, not merely self-correction.
• Hidden Acceptance Constraints: Reviewer feedback frequently enforces correctness, API discipline, concurrency safety, error handling, and performance constraints absent from the initial crash report. Explicit "Changes since vN" notes capture only 36.4% of actual revision categories; much refinement remains implicit and undocumented.

  Figure 2: Quarterly breakdown of review effort, showing intensive revision cycles and discussion depth across patch versions for syzbot-reported bugs.

• Patch Size Is a Poor Proxy for Difficulty: Small final patches may mask lengthy diagnostic and revision histories, reflecting the complexity of root-cause localization and reviewer alignment.

PatchAdvisor: Evolution-Aware Kernel Repair System

Motivated by these findings, the paper introduces PatchAdvisor—a repair framework combining a retrieval-based memory layer and a fine-tuned diagnostic advisor.

• Memory Layer: Structured into instance, pattern, and embedding memory, distilling bug types, fix patterns, reviewer lessons, and historic repair context. Semantic retrieval surfaces analogous cases and common pitfalls.
• Fine-Tuned Advisor: Trained on patch evolution traces, the advisor emits repair-oriented summaries for new bugs—root-cause directions, repair constraints, patch strategies, and pitfalls. This summary steers a downstream coding agent to generate reviewer-aligned patches, distinct from one-shot patch generation.

  Figure 1: PatchAdvisor architecture: dataset, memory retrieval, advisor inference, and integration into LLM-based patch generation.

Strong Numerical Results

Evaluation on temporally held-out syzbot patch cases demonstrates concrete gains:

• Reviewer-aligned Diagnostic Coverage Rate (DCR): Fine-tuned advisor achieves DCR of 0.88 versus 0.62–0.65 for base models.
• Code Generation Quality: Advisor-guided configuration (Gemma-3-12B) yields a fix rate of 5/6, CodeBERTScore of 0.91, and lowest average quality rank (2.7).
• Memory Retrieval Utility: F1 alignment with ground-truth revision categories improves by 21.8%, with notable precision and recall gain.
• Compilation Robustness: PatchAdvisor consistently improves compilation success and patch locality, avoiding common hallucination/fix-misdirection observed in unguided agents.

Practical and Theoretical Implications

Practically, PatchAdvisor demonstrates that leveraging patch revision history and review feedback as explicit supervision signals enables more reviewer-aligned, merge-worthy code generation in kernel repair. It addresses non-locality, acceptance constraint discovery, and revision responsiveness crucial for kernel development workflows.

Theoretically, the study challenges the sufficiency of crash-to-patch direct mappings in APR. It advocates for modeling the repair process as an iterative, reviewer–developer collaborative process, and reframes the learning objective for diagnostic guidance rather than code imitation.

Limitations and Future Directions

Sample size for end-to-end evaluation is constrained by strict inclusion criteria (multi-version history, usable C reproducer, temporal separation). Fine-tuning benefits vary with model capacity—overfitting is observed at lower scale. Multi-file architectural reasoning (e.g., RCU refactoring) remains unsolved in current agents.

Future work should scale evaluation, extend reasoning to architectural and concurrency-sensitive fixes, and integrate advanced verification. PatchAdvisor's supervision paradigm can be generalized for other large-scale, review-driven repositories and incorporated into agentic workflows with memory–retrieval and diagnostic guidance.

Conclusion

This study provides quantitative and structural evidence that accepted Linux kernel patches are shaped by non-locality, iterative revision, and reviewer-imposed constraints absent from crash reports. The PatchAdvisor framework operationalizes patch-evolution history as actionable repair guidance, measurably improving both diagnostic alignment and end-to-end fix outcomes. Automated kernel repair—in contrast to user-space APR—must explicitly learn the dynamics of patch evolution, reviewer constraints, and non-local causal reasoning to attain merge-quality results. PatchAdvisor constitutes a promising step toward evolution-aware, principled AI-assisted kernel repair.