Microsoft published a FORGE Lab write-up on November 11, 2026, describing a three-month effort to find Linux kernel bugs using an AI-powered vulnerability-scanning system codenamed MDASH. The system scanned kernel subsystems including networking, filesystems and security modules, producing 59 upstream bug reports and 33 assigned CVEs.
Quick Take
- What: Microsoft’s MDASH AI scanner found 59 Linux kernel bugs, resulting in 33 CVEs, with working root privilege-escalation exploits confirmed for eight
- Who is affected: Linux kernel users are affected through the CVEs, with 24 rated High or above
- Models used: Four frontier models (Sonnet 4.6, GPT-5.4, GPT-5.5, Opus 4.6) performed scanning and proof-of-concept work
- Fixes: 38 of 59 reports already have fixes merged into mainline
- What to do: Apply kernel fixes as your distribution ships them, prioritizing High-rated CVEs from this batch
In plain English
Microsoft used an AI system to scan the Linux kernel for security bugs and found 33 serious flaws, eight of which can let an attacker gain full control of a computer. The bugs are old, averaging 8.1 years, with the oldest at least 21 years old. Most have already been fixed in the main Linux code.
What you should do: If you use Linux, install security updates from your distribution when they become available, especially for the more serious bugs. The AI found thousands of possible problems but human experts had to check each one, and Microsoft says the human review step was slower than the AI scanning.
What happened
Microsoft’s FORGE Lab published a write-up on November 11, 2026, bylined to Cen Zhang and the FORGE Lab team, describing a three-month effort to find Linux kernel bugs with AI. The team used a system codenamed MDASH to scan kernel subsystems including networking, filesystems and security modules.
A companion FORGE Lab post describes MDASH as an AI-powered vulnerability-scanning system whose findings also feed a Microsoft Defender capability.
How it works
MDASH scanned subsystems and emitted confidence-rated findings, which were screened and then passed to a proof-of-concept step that had to actually run a candidate bug before it counted as evidence. Four frontier models (Sonnet 4.6, GPT-5.4, GPT-5.5, Opus 4.6) did the scanning and proof-of-concept work.
The funnel narrowed sharply at every stage:
- Raw findings: 26,502 in about two weeks
- Screened candidates: 11,769
- With PoC evidence: 621
- CVEs assigned: 33
- Rated High or above: 24
Microsoft says human validation and patching, not scanning, was the limiting step.
Who is affected
Linux kernel users are affected through the 33 CVEs, and Microsoft confirms working root privilege-escalation exploits for eight of them.
One example is CVE-2026-64563, a use-after-free in the rhashtable library. Microsoft traces it to a 2018 change that left a stale iterator pointer, and says an unprivileged user can reach it through Netlink socket diagnostics and turn it into a constrained kernel write.
The average bug age is 8.1 years, with the oldest at least 21 years old.
What you should do
Apply kernel fixes as your distribution ships them, and take the High-rated CVEs from this batch first. Microsoft reports that most of the 59 upstream reports already have fixes merged into mainline, which leaves the remainder still moving through maintainers.
What it means
This research demonstrates that AI systems can find real, exploitable vulnerabilities in mature codebases at scale. However, the sharp funnel from 26,502 raw findings to 33 CVEs shows that human validation remains essential. Microsoft’s finding that human review and patching was the bottleneck, not AI scanning, suggests that the limiting factor in vulnerability discovery may be shifting from finding bugs to validating and fixing them.
