Linux: 59 Vulnerabilities Tracked by an AI-Human Duo

Microsoft reports having identified 59 vulnerabilities in the Linux kernel using AI agents supported by researchers. This effort includes 33 CVEs, eight demonstrated local exploits, and a median integration time of 41 days, while validation and upstream coordination remain largely manual.

Merged patches, but integration spans 41 to 108 days

At the time of publication, 38 of the 59 reports had resulted in patches integrated into the main branch of the Linux kernel. Half of these patches were accepted on the first submission, while the others required between one and four revisions. Microsoft indicates a median time of 41 days between the first public submission and upstream integration, with the longest delay reaching 108 days. Discussions with maintainers were ongoing for the remaining reports.

Humans remain central: four person-months to consolidate two weeks of scans

The initial scans lasted about two weeks, but transforming the results into actionable reports and validated patches required over four person-months of effort. Vulnerability reports generally need to be accompanied by a functional patch: AI agents contributed to drafting initial patches, but validation, understanding of subsystems, and iteration with maintainers relied on human teams. Researchers believe that the search and bug-fixing process is imbalanced and that humans remain the bottleneck. The project only covered a small part of the Linux kernel; adjustments to the AI-assisted approach could uncover more bugs, but they caution that increasing the number of discovered vulnerabilities does not guarantee enhanced system security.

Old and severe flaws: average age 8.1 years, one case over 21 years

At the time of their public disclosure, the bugs had an average age of 8.1 years. A flaw identified under the reference CVE-2026-74544 had existed in the kernel for at least 21 years. In total, 33 CVEs were assigned to the discoveries, of which 24 are considered high severity or higher, according to CVSS v3.1 scores of at least 7.0.

Microsoft details eight local privilege escalations in the Linux kernel

Microsoft presented eight cases of local privilege escalation affecting various components, including IPv4, IPv6, IPsec routing, encrypted key management, and resizable hash tables. Some demonstrations involved using unusual parameters or disabling certain mitigations. A notable case, CVE-2026-64563, concerns the rhashtable implementation: a change in 2018 allowed a pointer to be retained during an iteration pause, which could lead to access to freed memory during resizing and deletions. Netlink socket diagnostics, accessible without privileges, allowed this flaw to be turned into a constrained kernel memory write primitive, potentially leading to local privilege escalation. This vulnerability was exploitable on standard Linux configurations without specific settings or user namespaces and also affected Android devices with SELinux in effect.

From massive sorting to the 59 reports published between late June and mid-October

Microsoft's FORGE Lab, through the MDASH project combining AI agents and researchers, identified 59 vulnerabilities in the Linux kernel, some of which had been present for over 20 years. The targeted subsystems included networking, file systems, and security modules. Approximately two weeks of scans generated 26,502 initial results, reduced to 11,769 through automated filtering. AI agents attempted to reproduce the vulnerabilities with QEMU, producing 621 proofs of concept, which were then analyzed by researchers to identify causes, merge duplicates, and prepare submissions. Ultimately, 59 cases resulted in public reports; 266 shared common causes and required the same patches, 163 were not submitted primarily due to limited security impact, and 133 were already known or fixed. June 27, 2026, marks the date of submission for the first public report. By September 1, 55 reports were listed on public mailing lists, while the last four had been reported privately before being made public by mid-October.