Microsoft AI project reports 59 long-lived Linux kernel bugs
Original title: AI found Linux kernel bugs that remained undetected for decades
Researchers built local root exploits for eight findings; 38 of 59 upstream reports already have fixes merged to mainline.
Microsoft’s FORGE Lab project MDASH used AI agents with human reviewers to scan selected Linux kernel subsystems and filed 59 public upstream vulnerability reports. Of 33 assigned CVEs, Microsoft said 24 rate High or above, and the team built working local privilege-escalation exploits for eight. Fixes for 38 reports were merged; work on the rest was still underway, and Microsoft said validation and maintainer review remained mostly human work.
Unconfirmed: Microsoft developed exploits for eight CVEs, but the post does not say those exploits are public or used in attacks.
- Scans produced 26,502 findings, then 621 proof-of-concept cases, then 59 reports.
- Average reported bug age was 8.1 years; CVE-2026-74544 was at least 21 years old.
- CVE-2026-64563 is a rhashtable use-after-free reachable via Netlink diagnostics.
- Microsoft said that flaw worked on standard Linux and SELinux-enforcing Android.
- Median time from first public patch to a mainline release was 41 days.
Impact: Local privilege escalation through kernel memory corruption
| Product | Affected |
|---|---|
| Linux kernel | — |
- 1.Track upstream Linux mainline fixes for the 59 Microsoft kernel reports.
- Products
- Linux kernel
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-64563 | Linux kernel: rhashtable: clear stale iter->p on table restart rhashtable_walk_start_check() has two restart paths when… | 7.8 | <1% | ||
| CVE-2026-74544 | Linux kernel: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds u32_change() copies the user-provided… | 7.8 | <1% |
From the original article
3 min read at csoonline.com
A Microsoft research project combining AI agents with human security researchers uncovered 59 Linux kernel vulnerabilities, including bugs that had survived in production code for more than 20 years. While AI dramatically accelerated the discovery process, the researchers found that validating flaws, developing patches, and working with maintainers remained overwhelmingly human-intensive.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.