Microsoft says an AI-assisted scan of parts of the Linux kernel has led to 59 public upstream bug reports and 33 assigned CVEs. Fixes for 38 of those reports have been merged into the mainline kernel. Its FORGE Lab also confirmed working local root privilege-escalation exploits for eight CVEs in controlled laboratory environments, though some required non-default settings or disabled exploit mitigations.
The team used a system codenamed MDASH to scan selected networking, filesystem and security components from late May to mid-June 2026. One full-time researcher and one intern led the three-month effort. Microsoft says it chose components that could be tested in QEMU without specialized hardware.
Researchers narrowed thousands of findings
About two weeks of scanning produced 26,502 raw findings. Automated screening reduced those to 11,769 candidates, and agents attempted to reproduce them in QEMU. Experts reviewed 621 cases backed by proof-of-concept evidence, checked their causes and prepared reports for Linux maintainers.
Those 621 cases yielded 59 public reports. Microsoft says 266 cases shared a root cause with another case, 163 were not reported after review, mostly because of limited security impact, and 133 had already been reported or fixed upstream. The first public report was posted on June 27, 2026.
Among the 33 assigned CVEs, 24 have a CVSS v3.1 score of at least 7.0. Microsoft highlighted CVE-2026-64563, a bug in the kernel’s resizable hash table that could let a local user gain root privileges on Linux. The company says the flaw also affected Android with SELinux enforcing.
Microsoft says agents helped draft fixes, but researchers still had to validate them and work through maintainer reviews. Of the 38 fixes merged into mainline, half were accepted on the first submission and the rest took one to four revisions. The company says it is still working with maintainers on the remaining reports.
