Newshot Microsoft Uses AI to Discover 59 Linux Kernel Vulnerabilities, Including Flaws Hidden for Over 20 Years
Microsoft's FORGE lab used an AI-driven scanning system to discover 59 security vulnerabilities in the Linux kernel, some of which had gone undetected for over 20 years.
To date, the work has led to the assignment of 33 CVE IDs, and Microsoft has confirmed that 8 of these vulnerabilities have exploitable local root privilege escalation PoCs.
The research team used a tool codenamed MDASH to conduct the scanning, which ran from late May to mid-June 2026. The entire project was led by one full-time researcher and one intern, and was completed over three months.
Currently, the fix patches corresponding to 38 vulnerability reports have been merged into the Linux kernel mainline, adding to what has already been a busy year for kernel security work.
Other teams have previously demonstrated the efficiency of AI in vulnerability discovery — for example, OpenAI's GPT-6 Cyber model generated hundreds of actually runnable Linux exploit programs. But what makes Microsoft's report different is that it also shows that even after AI completes the initial scan, a large amount of human effort is still required to finish the follow-up work.
Microsoft researchers disclosed these vulnerabilities and the discovery process in a blog post titled "Lessons from 59 Linux Kernel Bug Reports." Finding vulnerabilities is only the relatively easy part; confirming them, working out the root causes, and driving fixes takes far more time.