This paper presents KNighter, a novel approach for scalable static analysis of large systems (e.g., the Linux kernel) using Large-Scale Language Models (LLMs). Existing static analyzers are difficult to design and implement and are limited to specific bug patterns. Instead of directly analyzing large systems using LLMs, KNighter automatically generates specialized static analyzers using historical bug patterns and patch information. These analyzers are verified for accuracy by comparing them to original patches and are iteratively refined to reduce false positives. Evaluation results on the Linux kernel demonstrate that KNighter generates highly accurate checkers that detect a variety of bug patterns not detected by existing analyzers. KNighter discovered 92 new critical long-term bugs in the Linux kernel (with an average age of 4.3 years), of which 77 were confirmed, 57 were fixed, and 30 were assigned CVE numbers. This research presents a new paradigm for scalable, reliable, and traceable LLM-based static analysis for real-world systems through checker synthesis.
