Microsoft FORGE Lab Leverages AI to Uncover 59 Linux Kernel Vulnerabilities
Microsoft's FORGE Lab utilized AI tools to scan Linux kernel subsystems, identifying 59 public reports and 33 CVEs, with eight confirmed root privilege-escalation exploits.
Microsoft's FORGE Lab has announced the discovery of 59 new public reports and 33 assigned CVEs stemming from an AI-assisted scan of Linux kernel subsystems. The initiative, codenamed MDASH, employed advanced AI models including Sonnet and GPT variants to analyze core kernel components like networking, filesystems, and security modules. This extensive effort, conducted over a three-month period, highlights the growing potential of artificial intelligence in scaling vulnerability discovery within complex open-source projects.
The initial scans generated a massive dataset of 26,502 raw findings in just two weeks. However, transforming these raw outputs into actionable intelligence required significant human expertise. A rigorous filtering process, aided by AI-driven confidence levels and custom screening agents, narrowed the pool to 11,769 candidates. Subsequently, AI-powered reproduction agents attempted to generate proof-of-concept exploits in a QEMU environment for 621 of these cases, with human experts then meticulously reviewing these findings to identify root causes, consolidate duplicates, and prepare submissions to the Linux kernel community.
Out of the 621 cases with proof-of-concept evidence, approximately 9.5% resulted in a new public upstream report, totaling 59 distinct findings. The primary reasons for not filing separate reports included shared root causes (42.8%), limited security impact upon expert review (26.2%), or the vulnerability already being reported or fixed upstream (21.4%). This meticulous process underscores the challenges in distinguishing novel vulnerabilities from existing ones and the importance of expert validation.
Crucially, eight of the identified CVEs were confirmed to have working root privilege-escalation exploits in laboratory settings, posing a significant risk to systems running vulnerable Linux kernel versions. These vulnerabilities, detailed in the article, include various use-after-free flaws, a heap buffer overflow, and a refcount underflow, primarily affecting networking and security-related components. The confirmation of exploitability for these high-severity issues emphasizes the need for prompt patching.
Interestingly, the research revealed that many of the discovered bugs were quite old, with the average reported vulnerability having existed in the kernel for 8.1 years. One particularly concerning finding, CVE-2026-74544, was traced back at least 21 years, illustrating the long-standing nature of some security weaknesses within widely used software. This finding suggests a substantial backlog of unaddressed vulnerabilities in mature codebases.
Microsoft's FORGE Lab reported that fixes for 38 of the 59 identified issues have already been merged into the mainline Linux kernel, with the remaining patches still under active collaboration with maintainers. The process of getting fixes merged into upstream Linux typically involves submitting a working patch, and the AI tools assisted in drafting initial fixes, though human expertise remained critical for validation and iteration with maintainers. The median time from the first public patch to a mainline release was 41 days.
This project demonstrates a powerful synergy between AI and human security researchers. While AI tools can dramatically accelerate the initial discovery and reproduction phases, the nuanced understanding, strategic decision-making, and collaborative patching required for open-source projects like the Linux kernel still necessitate skilled human intervention. The findings from this initiative offer valuable insights into the effectiveness of AI in large-scale vulnerability discovery and the persistent challenges in securing complex software ecosystems.