---
title: Microsoft's AI scanner found 26,502 raw Linux kernel findings in two weeks; months of human work turned them into 59 reports, 33 CVEs and 8 root exploits | ctxsec
url: https://ctxsec.com/items/microsoft-forge-lab-mdash-ai-scan-linux-kernel-59-reports-33-cves-8-root-exploits
description: "Microsoft's FORGE Lab used its AI scanning system, codename MDASH, on a subset of Linux kernel subsystems (networking, filesystems, security modules) from late May to mid-June 2026. 26,502 raw findings were screened to 11,769 candidates; agents reproduced 621 in QEMU, and experts turned those into 59 public upstream reports, 33 CVEs (24 rated High or above) and 38 merged fixes. Microsoft confirmed local root exploits for eight CVEs in the lab, some needing non-default settings or disabled mitigations. The reported bugs averaged 8.1 years old."
status: "vendor research (Microsoft FORGE Lab, Nov 11, 2026)"
published: 2026-11-11
---

> Microsoft's FORGE Lab used its AI scanning system, codename MDASH, on a subset of Linux kernel subsystems (networking, filesystems, security modules) from late May to mid-June 2026. 26,502 raw findings were screened to 11,769 candidates; agents reproduced 621 in QEMU, and experts turned those into 59 public upstream reports, 33 CVEs (24 rated High or above) and 38 merged fixes. Microsoft confirmed local root exploits for eight CVEs in the lab, some needing non-default settings or disabled mitigations. The reported bugs averaged 8.1 years old.

[← AI](/ai) · [markdown](/items/microsoft-forge-lab-mdash-ai-scan-linux-kernel-59-reports-33-cves-8-root-exploits.md)

vendor research (Microsoft FORGE Lab, Nov 11, 2026)

2026-11-11 3:36 PM ET

### Microsoft's AI scanner found 26,502 raw Linux kernel findings in two weeks; months of human work turned them into 59 reports, 33 CVEs and 8 root exploits

- **Models:** code scanning mainly used Sonnet 4.6, GPT-5.4 and GPT-5.5; reproduction mainly GPT-5.5, Opus 4.6 and GPT-5.5-cyber.
- **Notable bug:** CVE-2026-64563, a one-line missed reset in the kernel's rhashtable walker that unprivileged users can reach through Netlink socket diagnostics, gave a stable root exploit on Linux and on Android with SELinux enforcing. NebuSec found it independently.
- **Other root-exploitable CVEs:** CVE-2026-64554, 64580, 74561, 74562, 89789, 98222 and 98364 (IPv6, IPv4 next-hop, GTP, encrypted keys, xfrm).
- **Microsoft's takeaway:** discovery is cheap compared with validation and fixing; reaching a mainline release took a median of 41 days, and human review is still the bottleneck.
- **For defenders:** keep kernels current on internet-facing Linux hosts, where local privilege escalation turns a web shell into root.

Sources: [Microsoft Security Blog: Lessons from 59 Linux Kernel Bug Reports (FORGE Lab, Nov 11, 2026)](https://www.microsoft.com/en-us/security/blog/2026/11/11/lessons-from-59-linux-kernel-bug-reports/)