Microsoft MDASH Finds 33 Linux Kernel CVEs, 38 Fixes

Microsoft’s FORGE Lab says an AI-assisted audit of parts of the Linux kernel, run under the codename MDASH, has so far produced 59 public upstream reports, 33 assigned CVEs, and 38 fixes merged into mainline. In an 11 November 2026 Microsoft Security Blog post, the lab said it scanned a subset of kernel subsystems from late May to mid-June 2026. “One full-time researcher and one intern led this three-month effort.” The figures in that post are Microsoft’s own.

They are also historical. The bugs were reported and patched upstream over the following months, not presented as new zero-days this week. Microsoft describes “working root privilege-escalation exploits for eight of those CVEs” as demonstrated “in controlled laboratory environments, with some cases requiring non-default settings or disabled exploit mitigations.” It does not report in-the-wild exploitation.

The volume of raw output is the point Microsoft wants to make. “The initial scans produced 26,502 raw findings in about two weeks,” on two servers, before screening agents reduced the pool to 11,769 candidates. Proof-of-concept agents then attempted reproduction, and “experts then reviewed the 621 cases with PoC evidence.” From those, 59 public reports were filed, about one in ten. Of the 621, Microsoft says 133, or 21.4 percent, were already reported or fixed upstream. The first public report went out on 27 June 2026, more than five weeks after scanning started.

Code scanning, Microsoft says, “mainly used Sonnet 4.6 (71.1% of code-scanning tokens), GPT-5.4 (20.1%), and GPT-5.5 (7.1%).” Across the 59 reports, “the average bug was 8.1 years old when we first reported it publicly.” One of the oldest, a cls_u32 bug tracked as CVE-2026-74544, “had been there for at least 21 years.” Of the 33 CVEs assigned so far, 24 are rated High or above. Reaching a mainline release from the first public patch took a median of 41 days.

A hashed-table bug, already fixed, and a human bottleneck

One of the eight laboratory-demonstrated local root cases is CVE-2026-64563, published by the Linux kernel CNA on 4 August 2026. Microsoft describes it as a use-after-free in rhashtable, the kernel’s shared resizable hash table, that “enabled a stable local privilege escalation on Linux—and affected Android with SELinux enforcing—without requiring special kernel configurations or user namespaces.” Yuan Tan of NebuSec independently found the same bug, Microsoft says, and helped the upstream fix. That record is months old. The useful status for operators is that the flaw is already in the public CVE list and has been patched upstream, not that a new exploit is being published today.

Microsoft’s own conclusion is not that the models replaced kernel experts. “Finding bugs and fixing them are drastically out of balance.” Two weeks of scanning produced the raw findings, “but it took over four person-months to report 59 of them—and five months later, 38 fixes have been merged.” “For complex infrastructure like the Linux kernel, keeping humans in the loop is still necessary, making human effort the bottleneck.”

That argument sits next to other recent attempts to put models onto kernel and defensive work. Trend Micro’s ZDI sent a batch of unpatched Linux kernel flaws to public lists when coordination stalled, a reminder that the reporting path, not only discovery, is often the hard part. Trail of Bits has described using Codex to help get 149 CVE fixes into stable Linux, another case in which the model drafted and the humans still had to land the patches. OpenAI’s GPT-6 Cyber is being sold specifically as a model for defensive research, the same job Microsoft says consumed most of the calendar time after MDASH’s two-week scan. Anthropic has also described an unreleased model finding dozens of Chrome flaws that were then patched, a different codebase with the same pattern: the finding is only finished when a maintained fix exists.

The scan was fast; the merge was not

MDASH is better read as a pipeline study than as a week’s worth of new kernel holes. Microsoft says a two-week scan produced tens of thousands of raw hits, a few hundred proof-of-concept cases, and 59 reports, of which 38 have been merged, with an average bug age of 8.1 years. The eight local-root cases, including CVE-2026-64563, were demonstrated in the lab and have already been handled upstream. Microsoft does not claim they were exploited in the wild. The bottleneck it names is human review, both inside the research team and among kernel maintainers who still have to accept a patch.

The facts to watch are the remaining reports that have not yet been merged, and whether later official counts revise the 33 CVEs or the eight laboratory root cases. Until then, the 11 November post is an account of work already done on the public lists, not a warning about unpatched zero-days.