Microsoft AI scan reports 59 Linux kernel bugs, eight with root exploits
Original title: Microsoft AI Exposes 21-Year-Old Linux Kernel Bug Among 59 Security Issues Reported to Maintainers
Thirty-three CVEs were assigned, 24 rated high or above, and 38 fixes have reached mainline.
Microsoft’s MDASH scanning effort, run by one researcher and one intern from late May to mid-June 2026, reported 59 Linux kernel security issues upstream. The team scanned networking, filesystems and security modules, then used models including Sonnet 4.6, GPT-5.4, GPT-5.5, Opus 4.6 and GPT-5.5-cyber to screen findings and generate QEMU proofs of concept. Humans accepted 9.5 percent of 621 PoC-backed cases. Working local root exploits were confirmed for eight bugs, mostly use-after-free, and 38 fixes are in mainline.
Unconfirmed: Microsoft reports the results; some exploits needed non-default settings or disabled mitigations, and real-world attacks are not stated.
- Two servers produced 26,502 raw findings, narrowed to 11,769 candidates.
- Reported bugs averaged 8.1 years old; three were at least 20 years old.
- CVE-2026-74544, a cls_u32 shift-out-of-bounds flaw, went unnoticed for 21 years.
- CVE-2026-64563 is a one-line rhashtable bug reachable by unprivileged netlink users.
- Median time from first public patch to a mainline release was 41 days.
Impact: local root privilege escalation on standard kernels
| Product | Affected |
|---|---|
| Linux kernel | — |
| Google Android | SELinux-enforcing builds affected by CVE-2026-64563 |
- 1.Apply the 38 fixes that have reached mainline.
- 2.Prioritize the eight confirmed local root privilege-escalation bugs.
- Vendors
- Microsoft
- Products
- Linux kernelAndroid
- Organizations
- NebuSec
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-64563 | Linux kernel: rhashtable: clear stale iter->p on table restart rhashtable_walk_start_check() has two restart paths when… | 7.8 | <1% | ||
| CVE-2026-64580 | Linux kernel: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() | 7.8 | <1% | ||
| CVE-2026-74544 | Linux kernel: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds u32_change() copies the user-provided… | 7.8 | <1% | ||
| CVE-2026-98222 | Linux kernel: KEYS: encrypted: fix integer overflow of datablob_len encrypted_key_alloc() stores datablob_len in a u16 | — | — |
From the original article
3 min read at gbhackers.com
AI-driven scanning system, codenamed MDASH, to find 59 security issues in the Linux kernel. One of them, a cls_u32 shift-out-of-bounds flaw tracked as CVE-2026-74544, had gone unnoticed for at least 21 years. One full-time researcher and one intern scanned selected kernel subsystems, including networking, filesystems and security modules, from late May to mid-June 2026.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.