Ask HN: What are some common techniques to hide vulns in code to identify?

Say there’s a project like the Linux kernel which accepts a high volume of patches from possibly malicious entities (e.g. Chinese companies). What are some common back doors or exploits they could try to hide within a block of legitimate changes? What are some ways to more easily spot them?