Lessons from 59 Linux Kernel Bug Reports
Microsoft's FORGE Lab discovered 59 Linux kernel vulnerabilities using AI-assisted scanning, with eight confirmed root-escalation exploits and 38 fixes already merged.
Microsoft's FORGE Lab conducted a three-month vulnerability research project using their AI system codenamed MDASH, scanning selected Linux kernel subsystems between late May and mid-June 2026. The effort, led by one full-time researcher and one intern, produced 59 public upstream reports and 33 assigned CVEs (Common Vulnerabilities and Exposures).
The researchers confirmed working root privilege-escalation exploits for eight of these CVEs, with fixes for 38 reports already merged into the mainline Linux kernel. The most significant finding was CVE-2026-64563, a flaw in the rhashtable component that enabled local privilege escalation on both Linux and Android systems without requiring special configurations.
From Scans to Reports
The MDASH system generated 26,502 raw findings in just two weeks using two servers with significant computing power. After filtering low-confidence claims and generating proof-of-concept evidence, the researchers narrowed down to 621 cases with reproducible bugs. From these, they submitted 59 public reports, achieving a 9.5% conversion rate from PoC-backed cases to final reports.
The scanning process primarily used Sonnet 4.6 (71.1% of code-scanning tokens), GPT-5.4 (20.1%), and GPT-5.5 (7.1%). For proof-of-concept generation, GPT-5.5 dominated with 77.3% of reproduction tokens, followed by Opus 4.6 (13.2%) and GPT-5.5-cyber (9.4%).
Age of Discovered Bugs
A striking finding was the age of the vulnerabilities. Across the 59 reports, the average bug had been present in the kernel for 8.1 years before being discovered. One particularly old issue, a cls_u32 shift-out-of-bounds bug (CVE-2026-74544), had remained undetected for at least 21 years. Six bugs were between 15-19 years old, and three were at least 20 years old when discovered.
Finding bugs and fixing them are drastically out of balance. Two weeks of codename MDASH scanning produced the initial findings, which we narrowed to 621 PoC-backed cases. But it took over four person-months to report 59 of them—and five months later, 38 fixes have been merged.
Fix Integration Process
The vulnerability reporting process revealed significant challenges in getting fixes integrated. While AI helped generate initial patches, human validation and collaboration with kernel maintainers remained essential. Fixes for 38 reports have been merged into the mainline Linux kernel, with half accepted on first submission and the rest requiring one to four revisions.
The time from first public patch to mainline release averaged 41 days, with some taking up to 108 days. Among the 33 CVEs assigned, 24 were rated High severity or above (CVSS v3.1 score of at least 7.0). The researchers emphasized that while AI can expand vulnerability discovery scope, building practical security solutions remains the more urgent challenge.
Related
