Microsoft Discovers 59 Linux Kernel Security Bugs Using AI, Including Flaws Hidden for Over 20 Years

Microsoft’s FORGE Lab used an AI-driven scanning system to find 59 security bugs in the Linux kernel. Some of them sat unnoticed for more than 20 years.

The work has so far led to 33 assigned CVEs, and Microsoft confirmed working root privilege-escalation exploits for eight of them.

The team used a tool with the codename MDASH. It scanned selected kernel areas from late May to mid-June 2026, and a full-time researcher and an intern led the three-month effort.

Fixes for 38 of the reports have already been merged into the main Linux kernel. The results add to a busy year for kernel security.

Other teams have also shown how fast AI can find weak spots, such as OpenAI’s GPT-6 Cyber model, which built hundreds of working Linux exploits. Microsoft’s report is different because it also shows how much human work is needed after the AI finishes.

Researchers at Microsoft identified the flaws and described the process in a blog post titled “Lessons from 59 Linux Kernel Bug Reports.” They noted that finding bugs is the easy part. Getting them confirmed, explained, and fixed takes far more time.

Microsoft Discovers 59 Linux Kernel Security Bugs

MDASH produced 26,502 raw findings in about two weeks, running on two servers. Many of these were weak or false leads, so the team filtered out low-confidence claims with confidence levels and extra screening agents.

That cut the pool to 11,769 candidates. Next, AI agents tried to reproduce each candidate in a test environment called QEMU. Experts then reviewed the 621 cases that had proof-of-concept evidence.

They looked for root causes, merged duplicates, and prepared reports for the Linux community. The code scanning mainly used Sonnet 4.6, GPT-5.4, and GPT-5.5. Reproduction used mostly GPT-5.5, along with Opus 4.6 and GPT-5.5-cyber.

Only 59 of the 621 cases (9.5%) became public reports. About 266 shared a root cause with another case, so one patch could fix them together.

Another 163 were dropped, mostly because their security impact was low. A further 133 had already been reported or fixed by someone else.

The bugs were old. On average, a reported bug had been in the kernel for 8.1 years. Six were 15 to 19 years old, and three were at least 20 years old.

The oldest, a cls_u32 shift-out-of-bounds bug tracked as CVE-2026-74544, had been there for at least 21 years. Similar long-hidden bugs have surfaced before, such as the GhostLock Linux kernel flaw that went unseen for about 15 years.

Inside CVE-2026-64563 and the Eight Exploitable Flaws

Of the 33 CVEs assigned so far, 24 are rated High or above, meaning a CVSS v3.1 score of 7.0 or more. The eight with confirmed local root exploits were tested in lab settings.

Some of them needed non-default settings or disabled protections. Most are use-after-free bugs, where the kernel keeps using memory after it has been freed.

Microsoft gave a closer look at CVE-2026-64563, a one-line bug in rhashtable, the kernel’s shared resizable hash table. A 2018 change kept a saved pointer when a table walk paused, but one resume path forgot to clear it.

If the table was resized and the entry freed in the meantime, the kernel later read freed memory. The bug stayed hidden for eight years because three rare events had to line up in the same walk.

Most code finishes a walk in one pass, so the problem almost never appeared by accident. The upstream fix is one line that clears the stale pointer.

The risk depends on which code calls the library. The exploitable caller is Netlink socket diagnostics, which unprivileged users can reach on standard kernels.

A local user could hold a listing paused, free the socket, and plant a fake pointer. That gives a limited 64-bit write, which is enough for privilege escalation on Linux and on Android with SELinux enforcing.

Yuan Tan and Frank Wu of NebuSec also worked on this bug, and Tan found it independently. Admins who want context on how such bugs are abused can read about the nftables privilege escalation bug, which also allowed root access through a use-after-free.

These bugs need local access. Attackers usually get that first through stolen logins or another weak service. Microsoft says finding and fixing bugs are badly out of balance. Reporting 59 cases took over four person-months.

Five months later, only 38 fixes were merged. Half of those were accepted on the first try, and the rest needed one to four revisions. From the first public patch to a mainline release took a median of 41 days, and up to 108 days.

Linux maintainers usually want a working patch with each report. AI agents helped draft the first fixes, but people still had to check them and work with maintainers.

Microsoft warns that too many real findings can overwhelm both bug hunters and maintainers, so teams should focus on high-severity problems. The team also scanned only a small part of the kernel, so more bugs likely remain.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs

The post Microsoft Discovers 59 Linux Kernel Security Bugs Using AI, Including Flaws Hidden for Over 20 Years appeared first on Cyber Security News.