Microsoft reports eight Linux kernel bugs enabled root exploits

Microsoft’s FORGE Lab, with Cen Zhang, reports that its MDASH scanning of Linux kernel subsystems from late May to mid‑June 2026 generated 26,502 raw findings in about two weeks, which were narrowed to 11,769 candidates and then 621 PoC‑backed cases. Eight of those led to confirmed local root privilege‑escalation exploits, and fixes for 38 of the reports have been merged into upstream mainline.

The team notes that turning scans into reproducible bugs, upstream reports and patches took months of expert investigation and collaboration with Linux maintainers, with a median of 41 days from first patch to mainline release for those fixes. The researchers say the early results illustrate the challenge of scaling vulnerability discovery while keeping humans in the loop.

Among the 59 upstream reports, 33 CVEs have been assigned, with 24 rated High or higher on CVSS v3.1.

The post highlights eight CVEs where local root exploits were confirmed in controlled labs, including CVE-2026-64563 in the rhashtable subsystem (described as a one‑line state‑reset bug enabling a stable local privilege escalation) and CVEs such as 64554 (net/ipv6 use‑after‑free in bridged fragmentation), 64580 (net/ipv6 refcount underflow in IPsec routing), and 74561/74562 (net/ipv4/IPv6 use‑after‑free in next‑hop replacement).

The report notes some bugs dated back many years—the average age across the 59 reports was 8.1 years, with the oldest, CVE-2026‑74544, present for at least 21 years. NebuSec researchers Yuan Tan and Frank Wu contributed independently, sharing real severity and exploitation work.