Linux Kernel vulnerabilities identified through MDASH research

Microsoft's FORGE Lab conducted an AI-driven security audit of core Linux kernel subsystems including networking, filesystems, and security modules. The research project, codenamed MDASH, analyzed codebases from late May to mid-June 2026. The effort produced 59 public upstream vulnerability reports, 33 of which were assigned CVEs, and confirmed working local root privilege escalation exploits for eight of the identified vulnerabilities. The average age of the reported bugs was 8.1 years, indicating deep-seated issues within established kernel components.

Impact

Observed impact includes the identification of 59 distinct security vulnerabilities in the Linux kernel. Eight of these flaws have been verified to allow local privilege escalation, which could enable an attacker to gain root-level access on vulnerable systems. Fixes for 38 of the reported issues have been integrated into the mainline Linux kernel.

Recommendation

• Inventory Linux systems and verify that kernels are updated to the latest stable versions to incorporate patches for the MDASH-reported vulnerabilities.
• Monitor upstream Linux kernel security lists and vendor advisories for the integration of the 38 merged fixes into downstream distributions (e.g., RHEL, Debian, Ubuntu, SLES).
• Prioritize patching for systems where unprivileged local users could potentially exploit the identified privilege escalation vulnerabilities in kernel subsystems such as networking and filesystems.