Pull to refresh
Logo
What Changed
Following Why Sign Up
Microsoft's AI bug hunt finds decades-old Linux kernel flaws

Microsoft's AI bug hunt finds decades-old Linux kernel flaws

New Capabilities

Two weeks of scanning produced 26,502 leads; 59 became public reports, including a cls_u32 flaw at least 21 years old.

4 days ago: Batch tally: 38 fixes and 33 CVEs

Overview

Updated 1 hour ago

For at least 21 years, a shift-out-of-bounds bug in Linux's cls_u32 traffic classifier sat in the kernel. An AI-assisted scan by Microsoft's FORGE Lab found it, along with 58 other flaws that became public reports.

The lab's MDASH tool produced 26,502 raw findings in about two weeks. Human reviewers turned 621 proof-of-concept cases into 59 public reports and 38 merged fixes. Discovery is not the bottleneck; validation and patching are.

Why it matters

The same AI scanning that finds decades-old kernel bugs can bury maintainers in reports, so triage and patching speed decide whether discovery improves security.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

26,502
Raw scan findings
Initial MDASH output from about two weeks of scanning.
621
Proof-of-concept cases
Cases that survived screening and reproduction attempts in QEMU.
59
Public upstream reports
Reports filed with Linux maintainers from the batch.
38
Merged fixes
Reports whose fixes had reached mainline Linux by November 11.
33
Assigned CVEs
Common Vulnerabilities and Exposures identifiers assigned from the batch.
8
Confirmed root exploits
CVEs for which Microsoft confirmed local privilege escalation in its lab.
8.1 years
Average bug age
Average time from the bug-introducing commit to the first public report.

Voices

Curated perspectives — historical figures and your fellow readers.

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

Yuan Tan
Yuan Tan
Security researcher at NebuSec
Independently found CVE-2026-64563 and shared exploit details
 Frank Wu
Frank Wu
Security researcher at NebuSec
Built a working privilege-escalation exploit for CVE-2026-64563

Organizations Involved

Microsoft
Microsoft
Technology company
Ran the MDASH scan through its FORGE Lab and published the results

Microsoft's FORGE Lab built and ran the MDASH AI scanning tool against Linux kernel subsystems.
LI
Linux kernel community
Open-source software project
Received the reports and merged 38 fixes into mainline

The maintainers who review Linux kernel patches and decide what reaches mainline.
NebuSec
NebuSec
Security research firm
Independently found and exploited CVE-2026-64563

A security research firm whose researchers worked on the rhashtable flaw alongside Microsoft.

Timeline

May 2026 November 2026

4 events Latest: 4 days ago
Tap a bar to jump to that date

  1. Batch tally: 38 fixes and 33 CVEs

    Latest Report

    Microsoft says 38 fixes are merged, 33 CVEs assigned, and eight root exploits confirmed.

  2. 55 reports reach public lists

    Disclosure

    Most of the 59 reports are posted publicly; four go through private disclosure first.

  3. First upstream report posted

    Disclosure

    Microsoft posts the first public report from the batch, more than five weeks after scanning started.

  4. MDASH scans begin

    Research

    Microsoft FORGE Lab scans Linux networking, filesystem and security subsystems, producing 26,502 raw findings in about two weeks.

Scenarios

1

Remaining MDASH fixes reach Linux mainline

Likely Resolves by Q2 2027

Discussed by: Microsoft FORGE Lab and Linux kernel maintainers

Microsoft says it is still working with maintainers on 21 reports. If review continues at the current pace, most should land within a year. The measure is merged fixes, not reports filed.

2

CVE-2026-64563 appears in Android bulletin as exploited

Unlikely Resolves by Q2 2027

Discussed by: Microsoft and Android security researchers

Microsoft confirmed a working Android exploit under SELinux enforcing. A public bulletin listing would turn a lab finding into an active mobile threat. No such listing has appeared.

3

Linux maintainers publish AI-report submission rules

Possible Resolves by End of 2027

Discussed by: Linux kernel maintainers and security researchers

The batch adds 59 reports to a volunteer review system. Maintainers may formalize how AI-generated findings should be screened and submitted. No policy has been announced.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

April 2014

Heartbleed (2014)

A missing bounds check in OpenSSL's heartbeat extension let attackers read up to 64 kilobytes of server memory per request. The flaw had sat in the library for about two years. It affected a large share of encrypted web traffic.

Then

Patches rushed out, companies revoked certificates, and administrators raced to update servers.

Now

The disclosure prompted industry-wide review of open-source funding and maintenance.

Why this matters now

Shows how a small flaw in shared infrastructure can expose many systems, and why coordinated disclosure matters.

September 2014

Shellshock (2014)

A parsing bug in Bash let attackers run commands through environment variables. The vulnerable code dated to 1989. Millions of Unix-like systems used Bash as a default shell.

Then

Emergency patches shipped and scanners searched for exposed systems.

Now

It became a reference case for decades-old open-source code reaching critical infrastructure.

Why this matters now

Like the cls_u32 bug, it shows how long a flaw can sit in widely used code before disclosure.

Sources

(6)
Microsoft Security Blog CSO Online GBHackers Cybersecurity Times Digital Journal Lemmy.World