Microsoft MDASH reports 59 Linux kernel bugs, eight with local root exploits
November 12: CSO Online adds that Microsoft said CVE-2026-64563 worked on standard Linux and SELinux-enforcing Android, and that validation stayed mostly human.
Microsoft’s MDASH scan yielded 59 Linux kernel reports and 33 CVEs; eight have lab root exploits, and 38 fixes are in mainline.
Microsoft’s FORGE Lab project MDASH scanned selected Linux kernel subsystems from late May to mid-June 2026 and filed 59 public upstream vulnerability reports, producing 33 assigned CVEs. Microsoft said 24 of those CVEs rate High or above. Researchers confirmed working local root privilege-escalation exploits for eight findings in the lab; GBHackers says most were use-after-free, and Microsoft says some needed non-default settings or disabled mitigations. Reported bugs averaged 8.1 years old. Fixes for 38 reports are in mainline, while work on the rest was still with maintainers. CSO Online reports that Microsoft said validation and maintainer review remained mostly human work.
- Scans produced 26,502 raw findings, then 621 proof-of-concept cases, then 59 reports.
- Humans accepted 9.5 percent of the 621 PoC-backed cases, according to GBHackers.
- CVE-2026-74544, a cls_u32 bug, had existed for at least 21 years.
- CVE-2026-64563 is a rhashtable use-after-free reachable via Netlink.
- Median time from first public patch to a mainline release was 41 days.
- Microsoft said CVE-2026-64563 worked on standard Linux and SELinux-enforcing Android.
What each outlet adds
beyond the shared facts- Microsoft Security BlogNames the models used and says some root exploits needed non-default settings.
- GBHackersReports one researcher and an intern, a 9.5 percent acceptance rate, and mostly use-after-free bugs.
- CSO OnlineSays the rhashtable flaw worked on SELinux-enforcing Android and review stayed mostly human.
- Vendors
- Microsoft
- Products
- Linux kernelAndroid
Coverage
oldest first · one row per article · UTC- · 1d ago
Microsoft Security BlogFirst report
Microsoft reports 59 Linux kernel bugs and 33 CVEs from AI scans
Eight CVEs had lab-confirmed local root exploits; fixes for 38 reports are in mainline, and bugs averaged 8.1 years old.
- · 19h ago
GBHackers
Microsoft AI scan reports 59 Linux kernel bugs, eight with root exploits
Thirty-three CVEs were assigned, 24 rated high or above, and 38 fixes have reached mainline.
- · 12h ago
CSO Online
Microsoft AI project reports 59 long-lived Linux kernel bugs
Researchers built local root exploits for eight findings; 38 of 59 upstream reports already have fixes merged to mainline.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-64563 | Linux kernel: rhashtable: clear stale iter->p on table restart rhashtable_walk_start_check() has two restart paths when… | 7.8 | <1% | ||
| CVE-2026-64580 | Linux kernel: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() | 7.8 | <1% | ||
| CVE-2026-74544 | Linux kernel: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds u32_change() copies the user-provided… | 7.8 | <1% | ||
| CVE-2026-98222 | Linux kernel: KEYS: encrypted: fix integer overflow of datablob_len encrypted_key_alloc() stores datablob_len in a u16 | — | — |