# Lessons from 59 Linux Kernel Bug Reports

> Source: <https://forge-blog.github.io/posts/linux-kernel-3-month-lookback/>
> Published: 2026-11-11 00:00:00+00:00

At Microsoft’s FORGE Lab, we used [codename MDASH](https://www.microsoft.com/en-us/security/blog/2026/05/12/defense-at-ai-speed-microsofts-new-multi-model-agentic-security-system-tops-leading-industry-benchmark/) to scan a subset of Linux kernel subsystems from late May to mid-June 2026. One full-time researcher and one intern led this three-month effort, which has so far produced [59 public upstream reports](https://lore.kernel.org/all/?q=mid%3A20261013051553.71887-1-cenzhang%40linux.microsoft.com+OR+mid%3A20261012215703.30592-1-cenzhang%40linux.microsoft.com+OR+mid%3A20260925024408.32143-1-cenzhang%40linux.microsoft.com+OR+mid%3A20260925015251.21168-1-cenzhang%40linux.microsoft.com+OR+mid%3A20260901183151.16648-1-cenzhang%40linux.microsoft.com+OR+mid%3A20260818164825.63967-1-blbllhy%40gmail.com+OR+mid%3A20260827051859.45511-1-blbllhy%40gmail.com+OR+mid%3A20260819145658.29872-1-blbllhy%40gmail.com+OR+mid%3A20260826154456.85974-1-blbllhy%40gmail.com+OR+mid%3A20260901182136.13745-1-cenzhang%40linux.microsoft.com+OR+mid%3A20260901180600.10394-1-cenzhang%40linux.microsoft.com+OR+mid%3A20260901175834.8557-1-cenzhang%40linux.microsoft.com+OR+mid%3A20260901174934.6275-1-cenzhang%40linux.microsoft.com+OR+mid%3A20260828041925.36758-1-blbllhy%40gmail.com+OR+mid%3A20260821182449.79785-2-blbllhy%40gmail.com+OR+mid%3A20260821182449.79785-3-blbllhy%40gmail.com+OR+mid%3A20260820200245.44312-1-blbllhy%40gmail.com+OR+mid%3A20260820010617.46851-1-blbllhy%40gmail.com+OR+mid%3A20260816035205.57966-1-blbllhy%40gmail.com+OR+mid%3A20260825052404.45665-3-blbllhy%40gmail.com+OR+mid%3A20260822045407.28983-1-blbllhy%40gmail.com+OR+mid%3A20260819014858.76707-1-blbllhy%40gmail.com+OR+mid%3A20260817013237.2797-1-blbllhy%40gmail.com+OR+mid%3A20260816173713.28998-1-blbllhy%40gmail.com+OR+mid%3A20260722193719.81157-1-blbllhy%40gmail.com+OR+mid%3A20260717210143.4734-1-blbllhy%40gmail.com+OR+mid%3A20260724164719.99563-1-blbllhy%40gmail.com+OR+mid%3A20260721143602.64677-1-blbllhy%40gmail.com+OR+mid%3A20260719232153.1405569-1-xmei5%40asu.edu+OR+mid%3A20260706212556.3199234-1-xmei5%40asu.edu+OR+mid%3A20260720204430.1886091-1-xmei5%40asu.edu+OR+mid%3A20260720223400.1939998-1-xmei5%40asu.edu+OR+mid%3A20260720034514.23053-1-blbllhy%40gmail.com+OR+mid%3A20260723000016.84091-1-blbllhy%40gmail.com+OR+mid%3A20260722223832.3524006-1-xmei5%40asu.edu+OR+mid%3A20260722004818.72310-1-blbllhy%40gmail.com+OR+mid%3A20260720155210.34229-1-blbllhy%40gmail.com+OR+mid%3A20260722002951.2614721-1-xmei5%40asu.edu+OR+mid%3A20260722002951.2614721-2-xmei5%40asu.edu+OR+mid%3A20260721232805.2451198-1-xmei5%40asu.edu+OR+mid%3A20260720214103.47732-1-blbllhy%40gmail.com+OR+mid%3A20260719221523.1336739-1-xmei5%40asu.edu+OR+mid%3A20260718183420.13301-1-blbllhy%40gmail.com+OR+mid%3ACAB8m9WgETt0AjmFwE%3DF-CKjGXsK6_WDv0%3DkbYRcC8-noo%2BamnA%40mail.gmail.com+OR+mid%3A20260713233230.3553593-1-xmei5%40asu.edu+OR+mid%3A20260713221551.3344650-1-xmei5%40asu.edu+OR+mid%3A20260713215510.3288580-1-xmei5%40asu.edu+OR+mid%3A20260711005955.1467140-1-xmei5%40asu.edu+OR+mid%3A20260710230724.942574-1-xmei5%40asu.edu+OR+mid%3A20260710014109.536177-1-xmei5%40asu.edu+OR+mid%3A20260709220501.395659-1-xmei5%40asu.edu+OR+mid%3A20260706232850.3333016-1-xmei5%40asu.edu+OR+mid%3A20260707203215.2752-1-blbllhy%40gmail.com+OR+mid%3ACAB8m9Wh559e%2B%3Dn8z51gB8DrbEyCc2mc0MgGjrRR6_VXBmU%3D2AQ%40mail.gmail.com+OR+mid%3A20260707015440.3420673-1-xmei5%40asu.edu+OR+mid%3A20260702185805.615241-1-xmei5%40asu.edu+OR+mid%3A20260702224519.800135-1-xmei5%40asu.edu+OR+mid%3A20260702010516.221830-1-xmei5%40asu.edu+OR+mid%3A20260627024023.2201160-1-xmei5%40asu.edi) and [33 assigned CVEs](cves.txt). We confirmed working root privilege-escalation exploits for eight of those CVEs, and fixes for 38 of our reports have been merged into mainline.

Finding the bugs was only part of the work. The initial scans produced 26,502 raw findings in about two weeks, but turning those results into reproducible bugs, upstream reports, and patches took months of expert investigation and collaboration with Linux maintainers.