# MDASH: Microsoft's AI scanner behind 33 Linux kernel CVEs

> Microsoft reports that an AI scanning run against the Linux kernel produced 33 CVEs, and that human review, not the scanner, was the bottleneck.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Research
- **Published by:** Microsoft
- **Disclosed:** 2026-11-11
- **Affects:** Linux kernel
- **Research by:** Cen Zhang, Microsoft FORGE Lab
- **Primary source:** https://www.microsoft.com/en-us/security/blog/2026/11/11/lessons-from-59-linux-kernel-bug-reports/
- **Page:** https://theinjection.dev/items/microsoft-mdash-linux-kernel-reports/

Microsoft's FORGE Lab reports that an AI scanning system it codenames MDASH drove 59 upstream Linux kernel bug reports and 33 assigned CVEs in three months, with working root privilege-escalation exploits confirmed for eight.

## What happened

Microsoft published a FORGE Lab write-up on November 11, 2026, bylined to Cen Zhang and the FORGE Lab team, on a three-month effort to find Linux kernel bugs with AI. The post says the team used a system codenamed MDASH to scan kernel subsystems including networking, filesystems and security modules. A companion FORGE Lab post describes MDASH as an AI-powered vulnerability-scanning system whose findings also feed a Microsoft Defender capability.

## How it works

MDASH scanned subsystems and emitted confidence-rated findings, which were screened and then passed to a proof-of-concept step that had to actually run a candidate bug before it counted as evidence. Four frontier models, named below, did the scanning and proof-of-concept work. The funnel narrowed sharply at every stage, and Microsoft says human validation and patching, not scanning, was the limiting step.

## Who is affected

Linux kernel users are affected through the CVEs counted below, and Microsoft confirms working root privilege-escalation exploits for eight of them. One example is CVE-2026-64563, a use-after-free in the rhashtable library: Microsoft traces it to a 2018 change that left a stale iterator pointer, and says an unprivileged user can reach it through Netlink socket diagnostics and turn it into a constrained kernel write.

## What to do

Apply kernel fixes as your distribution ships them, and take the High-rated CVEs from this batch first. Microsoft reports that most of the 59 upstream reports already have fixes merged into mainline, which leaves the remainder still moving through maintainers.

## Quick facts

- **Raw findings:** 26,502 in about two weeks
- **Screened candidates:** 11,769
- **With PoC evidence:** 621
- **CVEs:** 33 assigned, 24 rated High or above
- **Fixes merged:** 38 of 59 reports
- **Average bug age:** 8.1 years; oldest at least 21
- **Models used:** Sonnet 4.6, GPT-5.4, GPT-5.5, Opus 4.6

## Sources

1. [Microsoft Write-Up](https://www.microsoft.com/en-us/security/blog/2026/11/11/lessons-from-59-linux-kernel-bug-reports/)
2. [FORGE Lab on Rust](https://www.microsoft.com/en-us/security/blog/2026/11/09/forge-lab-uses-agentic-tools-to-identify-memory-safety-issues-in-rust/)