Microsoft AI Unearths Decades-Old Linux Kernel Vulnerabilities

Microsoft’s FORGE Lab, utilising artificial intelligence (AI) agents alongside human researchers, has uncovered 59 vulnerabilities in the Linux kernel, including several flaws that had remained undetected for more than two decades.

The research project, codenamed MDASH, generated 26,502 potential findings in approximately two weeks of scanning selected Linux kernel subsystems. The findings ultimately led to 59 public upstream reports, with Microsoft successfully developing working root privilege-escalation exploits for eight of these newly identified CVEs.

AI Accelerates Discovery, Humans Validate and Patch

The MDASH project significantly accelerated the initial bug discovery phase, but Microsoft stated that validating these flaws, creating patches, and coordinating with Linux kernel maintainers proved to be a predominantly human-intensive process.

Microsoft’s methodology involved AI agents scanning kernel components related to networking, filesystems, and security modules. After automated screening narrowed findings to 11,769 candidates, AI agents used QEMU, an open-source machine emulator, to attempt reproduction. This process yielded 621 cases with proof-of-concept evidence.

Human researchers then reviewed these cases to identify root causes, merge duplicates, and prepare upstream submissions, resulting in the 59 public vulnerability reports. Microsoft said fixes for 38 of these reports have since been merged into the Linux mainline.

Of the 33 CVEs assigned to the findings, 24 received a High or higher severity rating based on CVSS v3.1 scores of at least 7.0.

Decades-Old Flaws and Working Exploits

Among the 59 reported vulnerabilities, the average age of a bug was 8.1 years at the time Microsoft first reported it publicly. One particularly long-standing flaw, identified as CVE-2026-74544, had been present in the kernel for at least 21 years.

Microsoft successfully developed local privilege-escalation exploits for eight of the vulnerabilities. These affected critical kernel components such as IPv4 and IPv6 networking, IPsec routing, encrypted-key handling, and the resizable hash-table implementation.

One specific vulnerability, tracked as CVE-2026-64563, was found in the kernel’s rhashtable implementation, a shared resizable hash-table library. Microsoft traced this flaw to a 2018 code change that could allow a table-walk operation to retain a stale pointer. Under specific conditions, an attacker could manipulate memory to achieve a constrained kernel memory-write primitive, potentially leading to local privilege escalation on standard Linux configurations, including Android devices with SELinux enforcing.

Human Effort Remains the Bottleneck

Despite AI’s effectiveness in identifying potential vulnerabilities and drafting initial patches, human expertise was indispensable for validating findings and collaborating with kernel maintainers. The upstream Linux community typically requires a working patch to accompany vulnerability reports.

“Agents helped draft initial fixes, but human validation, subsystem understanding, and iterating with maintainers during review remained essential,” Microsoft researchers wrote in a blog post.

The median time from the first public patch submission to a mainline release was 41 days, with the longest taking 108 days. While the initial AI scans took about two weeks, converting these findings into validated reports and patches required more than four person-months of human labour.

Microsoft noted that the project covered only a small fraction of the Linux kernel and that further refinement of the AI-assisted approach could uncover additional bugs. However, the researchers cautioned that simply finding more vulnerabilities does not automatically lead to a more secure system. “More tokens may yield more bugs, but not a secure system,” the blog post concluded.