Lessons from 59 Linux Kernel Bug Reports

Microsoft's FORGE Lab used its multi-model agentic security system, codename MDASH, to scan a subset of Linux kernel subsystems from late May to mid-June 2026, producing 59 public upstream reports and 33 assigned CVEs, with working root privilege-escalation exploits confirmed for eight of those CVEs and fixes for 38 reports merged into mainline. The three-month effort, led by one full-time researcher and one intern, generated 26,502 raw findings in about two weeks, but converting those results into reproducible bugs, upstream reports and patches took months. The results show that agentic scanning can surface real kernel vulnerabilities at volume while human triage remains the bottleneck.

At Microsoft’s FORGE Lab, we used codename MDASH https://www.microsoft.com/en-us/security/blog/2026/05/12/defense-at-ai-speed-microsofts-new-multi-model-agentic-security-system-tops-leading-industry-benchmark/ to scan a subset of Linux kernel subsystems from late May to mid-June 2026. One full-time researcher and one intern led this three-month effort, which has so far produced 59 public upstream reports https://lore.kernel.org/all/?q=mid%3A20261013051553.71887-1-cenzhang%40linux.microsoft.com+OR+mid%3A20261012215703.30592-1-cenzhang%40linux.microsoft.com+OR+mid%3A20260925024408.32143-1-cenzhang%40linux.microsoft.com+OR+mid%3A20260925015251.21168-1-cenzhang%40linux.microsoft.com+OR+mid%3A20260901183151.16648-1-cenzhang%40linux.microsoft.com+OR+mid%3A20260818164825.63967-1-blbllhy%40gmail.com+OR+mid%3A20260827051859.45511-1-blbllhy%40gmail.com+OR+mid%3A20260819145658.29872-1-blbllhy%40gmail.com+OR+mid%3A20260826154456.85974-1-blbllhy%40gmail.com+OR+mid%3A20260901182136.13745-1-cenzhang%40linux.microsoft.com+OR+mid%3A20260901180600.10394-1-cenzhang%40linux.microsoft.com+OR+mid%3A20260901175834.8557-1-cenzhang%40linux.microsoft.com+OR+mid%3A20260901174934.6275-1-cenzhang%40linux.microsoft.com+OR+mid%3A20260828041925.36758-1-blbllhy%40gmail.com+OR+mid%3A20260821182449.79785-2-blbllhy%40gmail.com+OR+mid%3A20260821182449.79785-3-blbllhy%40gmail.com+OR+mid%3A20260820200245.44312-1-blbllhy%40gmail.com+OR+mid%3A20260820010617.46851-1-blbllhy%40gmail.com+OR+mid%3A20260816035205.57966-1-blbllhy%40gmail.com+OR+mid%3A20260825052404.45665-3-blbllhy%40gmail.com+OR+mid%3A20260822045407.28983-1-blbllhy%40gmail.com+OR+mid%3A20260819014858.76707-1-blbllhy%40gmail.com+OR+mid%3A20260817013237.2797-1-blbllhy%40gmail.com+OR+mid%3A20260816173713.28998-1-blbllhy%40gmail.com+OR+mid%3A20260722193719.81157-1-blbllhy%40gmail.com+OR+mid%3A20260717210143.4734-1-blbllhy%40gmail.com+OR+mid%3A20260724164719.99563-1-blbllhy%40gmail.com+OR+mid%3A20260721143602.64677-1-blbllhy%40gmail.com+OR+mid%3A20260719232153.1405569-1-xmei5%40asu.edu+OR+mid%3A20260706212556.3199234-1-xmei5%40asu.edu+OR+mid%3A20260720204430.1886091-1-xmei5%40asu.edu+OR+mid%3A20260720223400.1939998-1-xmei5%40asu.edu+OR+mid%3A20260720034514.23053-1-blbllhy%40gmail.com+OR+mid%3A20260723000016.84091-1-blbllhy%40gmail.com+OR+mid%3A20260722223832.3524006-1-xmei5%40asu.edu+OR+mid%3A20260722004818.72310-1-blbllhy%40gmail.com+OR+mid%3A20260720155210.34229-1-blbllhy%40gmail.com+OR+mid%3A20260722002951.2614721-1-xmei5%40asu.edu+OR+mid%3A20260722002951.2614721-2-xmei5%40asu.edu+OR+mid%3A20260721232805.2451198-1-xmei5%40asu.edu+OR+mid%3A20260720214103.47732-1-blbllhy%40gmail.com+OR+mid%3A20260719221523.1336739-1-xmei5%40asu.edu+OR+mid%3A20260718183420.13301-1-blbllhy%40gmail.com+OR+mid%3ACAB8m9WgETt0AjmFwE%3DF-CKjGXsK6 WDv0%3DkbYRcC8-noo%2BamnA%40mail.gmail.com+OR+mid%3A20260713233230.3553593-1-xmei5%40asu.edu+OR+mid%3A20260713221551.3344650-1-xmei5%40asu.edu+OR+mid%3A20260713215510.3288580-1-xmei5%40asu.edu+OR+mid%3A20260711005955.1467140-1-xmei5%40asu.edu+OR+mid%3A20260710230724.942574-1-xmei5%40asu.edu+OR+mid%3A20260710014109.536177-1-xmei5%40asu.edu+OR+mid%3A20260709220501.395659-1-xmei5%40asu.edu+OR+mid%3A20260706232850.3333016-1-xmei5%40asu.edu+OR+mid%3A20260707203215.2752-1-blbllhy%40gmail.com+OR+mid%3ACAB8m9Wh559e%2B%3Dn8z51gB8DrbEyCc2mc0MgGjrRR6 VXBmU%3D2AQ%40mail.gmail.com+OR+mid%3A20260707015440.3420673-1-xmei5%40asu.edu+OR+mid%3A20260702185805.615241-1-xmei5%40asu.edu+OR+mid%3A20260702224519.800135-1-xmei5%40asu.edu+OR+mid%3A20260702010516.221830-1-xmei5%40asu.edu+OR+mid%3A20260627024023.2201160-1-xmei5%40asu.edi and 33 assigned CVEs cves.txt . We confirmed working root privilege-escalation exploits for eight of those CVEs, and fixes for 38 of our reports have been merged into mainline. Finding the bugs was only part of the work. The initial scans produced 26,502 raw findings in about two weeks, but turning those results into reproducible bugs, upstream reports, and patches took months of expert investigation and collaboration with Linux maintainers.