MDASH: Microsoft's AI scanner behind 33 Linux kernel CVEs
Microsoft reports that an AI scanning run against the Linux kernel produced 33 CVEs, and that human review, not the scanner, was the bottleneck.
· Microsoft · Research by Cen Zhang, Microsoft FORGE Lab
Microsoft's FORGE Lab reports that an AI scanning system it codenames MDASH drove 59 upstream Linux kernel bug reports and 33 assigned CVEs in three months, with working root privilege-escalation exploits confirmed for eight.
01What happened
Microsoft published a FORGE Lab write-up on November 11, 2026, bylined to Cen Zhang and the FORGE Lab team, on a three-month effort to find Linux kernel bugs with AI. The post says the team used a system codenamed MDASH to scan kernel subsystems including networking, filesystems and security modules. A companion FORGE Lab post describes MDASH as an AI-powered vulnerability-scanning system whose findings also feed a Microsoft Defender capability.
02How it works
MDASH scanned subsystems and emitted confidence-rated findings, which were screened and then passed to a proof-of-concept step that had to actually run a candidate bug before it counted as evidence. Four frontier models, named below, did the scanning and proof-of-concept work. The funnel narrowed sharply at every stage, and Microsoft says human validation and patching, not scanning, was the limiting step.
03Who is affected
Linux kernel users are affected through the CVEs counted below, and Microsoft confirms working root privilege-escalation exploits for eight of them. One example is CVE-2026-64563, a use-after-free in the rhashtable library: Microsoft traces it to a 2018 change that left a stale iterator pointer, and says an unprivileged user can reach it through Netlink socket diagnostics and turn it into a constrained kernel write.
04What to do
Apply kernel fixes as your distribution ships them, and take the High-rated CVEs from this batch first. Microsoft reports that most of the 59 upstream reports already have fixes merged into mainline, which leaves the remainder still moving through maintainers.
Sources 2 links, all fetched
- 1microsoft.comMicrosoft Write-Up
- 2microsoft.comFORGE Lab on Rust