Microsoft’s FORGE Lab has identified 59 previously undetected security vulnerabilities in the Linux kernel using an AI-based auditing tool, with some bugs lying dormant for over 20 years.
How the Discovery Happened
The effort, carried out between late May and mid-June 2026, unleashed MDASH, a scanning framework developed to comb through parts of the Linux kernel using artificial intelligence. During this scan, approximately 26,502 raw issue leads were flagged in just two weeks, operating on two servers. A series of filters, confidence metrics, and additional screening agents pared this down to 11,769 potential issues. From that set, AI agents attempted to reproduce each problem in a virtualized environment, leading to 621 cases with proof-of-concept evidence. Finally, 59 of those were elevated to full reports shared publicly. A research team of one full-time expert and an intern coordinated this three-month initiative.
The Most Concerning Flaws
Of the 59 issues, 33 have been assigned official CVE security identifiers so far. Among them, eight are confirmed to allow privilege escalation — specifically, access to root permissions under certain conditions. The majority are tied to use-after-free vulnerabilities, where freed memory gets accessed again improperly.
One bug highlighted was CVE-2026-64563, involving the shared rhashtable structure. The flaw arose due to a pointer not being cleared during a paused table walk, which, when resumed after resizing during memory freeing, may lead to reading freed memory. That specific bug had remained in the kernel for around eight years before discovery.
Age, Discovery, and Patch Status
The vulnerabilities are not recent. On average, they’ve existed in the kernel for over eight years. Six of the bugs are 15 to 19 years old, and three have been hiding for at least two decades. The oldest case, categorized as CVE-2026-74544, relates to a buffer shift error in the class u32 subsystem, and is estimated to be at least 21 years old.
Out of the 59 reports, fixes for 38 of them have already been merged into the mainline kernel. The process of patching involved multiple rounds of review, with half being accepted on their first go. From when the first patch was published to its inclusion in a mainline release, the median time was 41 days, though some took as many as 108 days.
A full breakdown of the high-severity bugs reveals flaws in modules like net/ipv6, net/ipv4, and drivers related to networking and security/keys. These include several use-after-free bugs, refcount underflows, and heap buffer overflows — all of which can pose significant risks under the right conditions.
Critical among the discovered issues are CVE-2026-64554 (in IPv6 fragmentation), CVE-2026-64563 (in rhashtable), CVE-2026-74561/-74562 (in IPv4 next-hop replacement), CVE-2026-89789 (in the GTP tunnel driver), CVE-2026-98222 (buffer overflow in encrypted-key updates), and CVE-2026-98364 (in IPsec routing). These bugs demand local access, meaning an attacker would first need to breach some form of access — like through a stolen credential or a vulnerable service — before exploiting them.
The AI-Human Lifecycle
The scanning tools used included Sonnet 4.6, GPT-5.4, GPT-5.5, Opus 4.6, and a domain-specific version dubbed GPT-5.5-cyber. AI played a major role in spotlighting issues and assisting with draft fixes, but the human role proved indispensable for verification, report generation, and liaising with kernel maintainers.
Microsoft points out the imbalance between bug discovery capacity driven by AI and the slower downstream process of confirmation, fixing, and patching. The 59 validated reports required more than four person-months of effort. Even with 38 fixes merged, roughly 35% of patches needed revisions and took well over a month to go from initial patch to mainline inclusion. Review cycles ranged from immediate acceptance to up to four rounds of edits.
Despite these findings, the scanning covered only parts of the kernel. Because many low-confidence or low-impact issues were filtered out, and others overlapped or had already been addressed, the researchers believe many more bugs may still be hidden in unscanned areas.
This isn’t the first case of long-dormant kernel vulnerabilities — earlier bugs like GhostLock had likewise lurked for over a decade. What makes this case stand out is the scale of AI’s involvement, the methods used, and the transparency in tracing bug age to CVE assignment and patch timelines.
These results underscore how tools like MDASH and modern AI agents can drastically accelerate vulnerability detection. But they also reveal that discovery is only one half of the battle — validation through proof-of-concept, patch crafting, code review, and community integration all remain human-intensive.
For kernel users and maintainers, these findings amplify urgency: patch promptly, audit dependency chains, tighten local access controls, and prepare for future AI-aided sweeps. As AI continues to advance, the industry must reconcile its power to uncover hidden flaws with mechanisms to fix them at scale.
