Microsoft AI scan finds 59 Linux kernel bugs, eight with root exploits
Original title: Microsoft Discovers 59 Linux Kernel Security Bugs Using AI, Including Flaws Hidden for Over 20 Years
Thirty-three CVEs are assigned so far, 24 rated High or above, and 38 fixes are already merged upstream.
Microsoft’s FORGE Lab used an AI scanner codenamed MDASH to find 59 Linux kernel security bugs, some present for more than 20 years. The work has produced 33 assigned CVEs, including eight with lab-confirmed local root exploits, and fixes for 38 reports are merged. Researchers said most confirmed cases are use-after-free bugs and that confirmation, reporting, and patch review took far longer than discovery.
Unconfirmed: The eight root exploits were confirmed in lab settings; some needed non-default settings or disabled protections.
- MDASH produced 26,502 raw findings, later cut to 621 cases with proof-of-concept evidence.
- Reported bugs averaged 8.1 years old; CVE-2026-74544 was at least 21 years old.
- Only 59 of 621 reviewed cases, 9.5%, became public reports.
- CVE-2026-64563 is a one-line rhashtable use-after-free reachable through Netlink diagnostics.
- Median time from first public patch to a mainline release was 41 days.
Impact: Local root privilege escalation, including on standard kernels
| Product | Affected |
|---|---|
| Linux kernel | — |
| Google Android | — |
- 1.Apply the upstream Linux kernel fixes already merged for the reported bugs.
- CVEs
- CVE-2026-64554CVE-2026-64563CVE-2026-64580CVE-2026-74544CVE-2026-74561CVE-2026-74562CVE-2026-89789CVE-2026-98222CVE-2026-98364
- Products
- Linux kernelAndroid
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-64554 | Linux kernel: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() br_ip6_fragment() gets prevhdr, a pointer… | 8.8 | <1% | ||
| CVE-2026-64563 | Linux kernel: rhashtable: clear stale iter->p on table restart rhashtable_walk_start_check() has two restart paths when… | 7.8 | <1% | ||
| CVE-2026-64580 | Linux kernel: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() | 7.8 | <1% | ||
CVE-2026-74562+2 related CVEs | Linux kernel: nexthop: take nh->lock for f6i_list walks in replace check and notify fib6_check_nh_list() and… | 8.8 group max | <1% | ||
| CVE-2026-89789 | Use-after-free in Linux kernel GTP module (gtp_newlink error path) | 7.8 | — | ||
CVE-2026-98364+1 related CVE | Use-after-free in Linux kernel XFRM bundle creation | 7.8 group max | — |
From the original article
4 min read at cybersecuritynews.com
Microsoft’s FORGE Lab used an AI-driven scanning system to find 59 security bugs in the Linux kernel. Some of them sat unnoticed for more than 20 years. The work has so far led to 33 assigned CVEs, and Microsoft confirmed working root privilege-escalation exploits for eight of them.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.