Microsoft's AI scanner found 26,502 raw Linux kernel findings in two weeks; months of human work turned them into 59 reports, 33 CVEs and 8 root exploits
- Models: code scanning mainly used Sonnet 4.6, GPT-5.4 and GPT-5.5; reproduction mainly GPT-5.5, Opus 4.6 and GPT-5.5-cyber.
- Notable bug: CVE-2026-64563, a one-line missed reset in the kernel's rhashtable walker that unprivileged users can reach through Netlink socket diagnostics, gave a stable root exploit on Linux and on Android with SELinux enforcing. NebuSec found it independently.
- Other root-exploitable CVEs: CVE-2026-64554, 64580, 74561, 74562, 89789, 98222 and 98364 (IPv6, IPv4 next-hop, GTP, encrypted keys, xfrm).
- Microsoft's takeaway: discovery is cheap compared with validation and fixing; reaching a mainline release took a median of 41 days, and human review is still the bottleneck.
- For defenders: keep kernels current on internet-facing Linux hosts, where local privilege escalation turns a web shell into root.
Sources: Microsoft Security Blog: Lessons from 59 Linux Kernel Bug Reports (FORGE Lab, Nov 11, 2026)