Microsoft reports 59 Linux kernel bugs and 33 CVEs from AI scans
Original title: Lessons from 59 Linux Kernel Bug Reports
Eight CVEs had lab-confirmed local root exploits; fixes for 38 reports are in mainline, and bugs averaged 8.1 years old.
Microsoft’s FORGE Lab used codename MDASH to scan Linux kernel subsystems from late May to mid-June 2026, producing 59 public upstream reports and 33 assigned CVEs. Scans yielded 26,502 raw findings, narrowed to 621 proof-of-concept cases and then 59 reports. Researchers confirmed local root privilege-escalation exploits for eight CVEs in the lab, and 24 of the 33 CVEs are rated High or above. Fixes for 38 reports are merged; the rest are still with maintainers.
Unconfirmed: Exploit confirmation was in a lab, and some cases needed non-default settings or disabled mitigations.
- Code scanning mainly used Sonnet 4.6, GPT-5.4 and GPT-5.5.
- Reproduction agents mainly used GPT-5.5, Opus 4.6 and GPT-5.5-cyber.
- Median time from first public patch to a mainline release was 41 days.
- CVE-2026-74544, a cls_u32 bug, had existed for at least 21 years.
- Some root exploits needed non-default settings or disabled mitigations.
Impact: Local root privilege escalation in the Linux kernel
| Product | Affected |
|---|---|
| Linux kernel | — |
- Products
- Linux kernel
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-64563 | Linux kernel: rhashtable: clear stale iter->p on table restart rhashtable_walk_start_check() has two restart paths when… | 7.8 | <1% | ||
| CVE-2026-74544 | Linux kernel: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds u32_change() copies the user-provided… | 7.8 | <1% |
From the original article
8 min read at microsoft.com
Microsoft FORGE Lab researchers used codename MDASH to investigate Linux kernel vulnerabilities, resulting in 59 upstream bug reports, 33 assigned CVEs, and 38 merged fixes. The research includes eight demonstrated local root privilege-escalation exploits and examines the challenges of turning AI-generated findings into validated vulnerabilities and upstream fixes.
By FORGE Lab and Cen Zhang · microsoft.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.