{"slug": "ai-found-linux-kernel-bugs-that-remained-undetected-for-decades", "title": "AI found Linux kernel bugs that remained undetected for decades", "summary": "Microsoft's FORGE Lab, under the codename MDASH, reported 59 Linux kernel vulnerabilities found by combining AI agents with human security researchers, including one bug, CVE-2026-74544, present in the kernel for at least 21 years. The project generated 26,502 potential findings in about two weeks of scanning networking, filesystems and security modules, narrowing them to 11,769 candidates through automated screening and 621 proof-of-concept cases via QEMU emulation; 33 CVEs were assigned, 24 rated High or higher at CVSS v3.1 scores of at least 7.0, and fixes for 38 reports have been merged into mainline. Microsoft developed working local privilege-escalation exploits for eight CVEs, including CVE-2026-64563 in the rhashtable implementation, traced to a 2018 code change and exploitable on standard Linux configurations and Android devices with SELinux enforcing, while the average reported bug age was 8.1 years.", "body_md": "A Microsoft research project combining AI agents with human security researchers uncovered 59 Linux kernel vulnerabilities, including bugs that had survived in production code for more than 20 years.\n\nWhile AI dramatically accelerated the discovery process, the researchers found that validating flaws, developing patches, and working with maintainers remained overwhelmingly human-intensive.\n\nThe research, conducted by Microsoft’s FORGE Lab under the codename MDASH, generated 26,502 potential findings in approximately two weeks of scanning selected Linux kernel subsystems. Automated screening, proof-of-concept testing, and human validation narrowed these down to 59 public upstream reports, Microsoft [said](https://www.microsoft.com/en-us/security/blog/2026/11/11/lessons-from-59-linux-kernel-bug-reports/) in a blog post.\n\n“We developed working root privilege-escalation exploits for eight of those CVEs, and fixes for 38 of our reports have been merged into mainline,” the researchers said in the blog post.\n\nMicrosoft said it scanned selected kernel components covering networking, filesystems, and security modules. The initial findings were reduced to 11,769 candidates through automated screening. AI agents then attempted to reproduce potential vulnerabilities using QEMU, an open-source machine emulator.\n\nThis produced 621 cases with proof-of-concept evidence. Human researchers reviewed these cases to identify root causes, merge duplicates, and prepare upstream submissions, the blog post added.\n\nOf the 621 cases, 59 resulted in public upstream reports. Microsoft said another 266 shared root causes with other findings and could be addressed through the same patch. A further 163 were not reported following review, mostly because of limited security impact, while 133 had already been reported or fixed upstream.\n\nMicrosoft said its first public report was submitted on June 27, 2026. By September 1, 55 of the 59 reports had been posted to public mailing lists. The remaining four were reported privately during the same period and routed to public lists by mid-October.\n\nOf the 33 CVEs assigned to the findings, 24 carry a High or higher severity rating, based on CVSS v3.1 scores of at least 7.0, according to Microsoft.\n\nThe eight vulnerabilities for which Microsoft developed working local privilege-escalation exploits affect several kernel components, including IPv4 and IPv6 networking, IPsec routing, encrypted-key handling and the resizable hash-table implementation. Some demonstrations required non-default settings or disabled exploit mitigations, the researchers said.\n\nOne finding, CVE-2026-64563, involves the kernel’s rhashtable implementation, a shared resizable hash-table library used by different kernel subsystems.\n\nMicrosoft traced the flaw to a 2018 code change that allowed a table-walk operation to retain a pointer when paused. Under specific conditions involving table resizing and the removal of an entry, the kernel could subsequently access freed memory through that stale pointer.\n\nThe researchers identified an exploitable path through Netlink socket diagnostics, which are accessible to unprivileged users. By manipulating memory, an attacker could turn the flaw into a constrained kernel memory-write primitive that, combined with other exploitation techniques, could enable local privilege escalation, Microsoft explained.\n\nThe company said this vulnerability was exploitable on standard Linux configurations without requiring special kernel configurations or user namespaces. It also affected Android devices with SELinux enforcing.\n\nAcross the 59 reports, the average age of a bug was 8.1 years when Microsoft first reported it publicly. One vulnerability, CVE-2026-74544, had been present in the kernel for at least 21 years, the researchers said.\n\nWhile AI agents helped identify potential vulnerabilities, generate proof-of-concept demonstrations and draft initial patches, Microsoft said human investigation remained necessary to validate findings and work with Linux kernel maintainers.\n\n“Upstream Linux typically requires vulnerability reports to come with a working patch. Agents helped draft initial fixes, but human validation, subsystem understanding, and iterating with maintainers during review remained essential,” the researchers wrote.\n\nFixes for 38 of the 59 reports had been merged into the upstream Linux mainline at the time of publication. Half were accepted with the initial submission, while the others required between one and four revisions. The median time from the first public patch submission to a mainline release was 41 days, with the longest taking 108 days, Microsoft said. Work with maintainers on the remaining reports was continuing.\n\nMicrosoft said the initial scans took about two weeks, but converting the findings into validated reports and patches required more than four person-months of work.\n\n“Finding bugs and fixing them are drastically out of balance,” the researchers wrote. “For complex infrastructure like the Linux kernel, keeping humans in the loop is still necessary, making human effort the bottleneck.”\n\nThe researchers said the project covered only a small fraction of the Linux kernel and that further tuning of the AI-assisted approach could uncover additional bugs. However, they cautioned that finding more vulnerabilities would not necessarily make systems more secure.\n\n“More tokens may yield more bugs, but not a secure system,” the blog post concluded.", "url": "https://wpnews.pro/news/ai-found-linux-kernel-bugs-that-remained-undetected-for-decades", "canonical_source": "https://www.csoonline.com/article/4247815/ai-found-linux-kernel-bugs-that-remained-undetected-for-decades.html", "published_at": "2026-11-12 12:09:51+00:00", "updated_at": "2026-11-12 12:22:46.172899+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-agents", "ai-safety", "machine-learning"], "entities": ["Microsoft", "FORGE Lab", "Linux kernel", "MDASH", "QEMU", "CVE-2026-64563", "CVE-2026-74544", "Android"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/ai-found-linux-kernel-bugs-that-remained-undetected-for-decades", "markdown": "https://wpnews.pro/news/ai-found-linux-kernel-bugs-that-remained-undetected-for-decades.md", "text": "https://wpnews.pro/news/ai-found-linux-kernel-bugs-that-remained-undetected-for-decades.txt", "jsonld": "https://wpnews.pro/news/ai-found-linux-kernel-bugs-that-remained-undetected-for-decades.jsonld"}}