AI-driven scanning system, codenamed MDASH, to find 59 security issues in the Linux kernel. One of them, a cls_u32 shift-out-of-bounds flaw tracked as CVE-2026-74544, had gone unnoticed for at least 21 years.
One full-time researcher and one intern scanned selected kernel subsystems, including networking, filesystems and security modules, from late May to mid-June 2026.
The team chose components that do not depend on specialized hardware, so QEMU-based validation stayed uniform. The effort produced 59 public upstream reports and 33 assigned CVEs.
Of those CVEs, 24 are rated High or above (CVSS v3.1 of at least 7.0). Working root privilege-escalation exploits were confirmed for eight, and 38 fixes have reached mainline.
Raw output was enormous. Two servers produced 26,502 findings in two weeks, mainly using Sonnet 4.6, GPT-5.4 and GPT-5.5 for scanning.
Confidence filtering and screening agents cut that to 11,769 candidates. PoC-generating agents then tried to reproduce them in QEMU, chiefly with GPT-5.5, Opus 4.6 and GPT-5.5-cyber, leaving 621 cases with proof-of-concept evidence.
Human experts reviewed those 621 cases, and only 9.5% became reports. Of the rest, 266 shared a root cause with another case, 163 had limited security impact, and 133 were already reported or fixed upstream.
Microsoft reported that , bugs averaged 8.1 years old at first public report. Six were 15 to 19 years old, and three were at least 20 years old. Upstream Linux typically expects a working patch with each report.
Agents drafted initial fixes, but humans validated them. Half of the merged fixes landed on the first submission, and the others needed one to four revisions.
The median time from first public patch to a mainline release was 41 days, with a maximum of 108.
The eight confirmed local root exploits span net/ipv6, net/ipv4, lib/rhashtable, the GTP driver, security/keys and net/xfrm. Most are use-after-free flaws .
CVE-2026-64580 is a refcount underflow, and CVE-2026-98222 is a heap buffer overflow in encrypted-key updates. Some required non-default settings or disabled mitigations.
The most detailed case is CVE-2026-64563, a one-line state-reset bug in rhashtable, the kernel’s shared resizable hash table.
A 2018 commit (5d240a8936f6) moved the clearing of the iterator pointer iter->p into rhashtable_walk_start_check(), but only on one of its two resume paths.
When a resize freed the old table, the function returned -EAGAIN with iter->p still set. The walk step then followed a possibly freed entry.
Exploitation needs three events to coincide: a paused and resumed iterator, a resize that frees the old table, and removal of the entry at iter->p.
That rarity explains why it survived eight years. The exploitable caller is __netlink_diag_dump(), which unprivileged users can reach on standard kernels.
An attacker controls the pause through recvmsg(), reallocates the freed socket, and plants a fake socket pointer. sock_diag_save_cookie() then performs a constrained 64-bit write, enough for local privilege escalation.
Android with SELinux enforcing was also affected. The upstream fix adds a single line, iter->p = NULL. NebuSec researchers Yuan Tan and Frank Wu independently found the bug and contributed working exploits.
Discovery now outpaces remediation. Reporting 59 cases took over four person-months, and five months on, 38 fixes are merged.
FORGE argues that human effort is the bottleneck, and that maintainers can be overwhelmed by real findings, so teams should prioritize high-severity issues. It also cautions that more tokens may find more bugs but will not by themselves make a system secure
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC .
Artificial Intelligence
Cyber security Course
Cyber Security Resources
Cybersecurity
Information Gathering
Information Security Risks
State- Hackers Deploy Up to 8 AI Agents to Target Taiwanese Government Systems
PoC Exploit Released for Critical Cisco Expressway RCE Vulnerability With CVSS 9.8 Score
Palo Alto Networks Patches PAN-OS Vulnerability Allowing Remote Code Execution With Root Privileges
Qilin Ransomware Gang Leader Allegedly Identified as 36-Year-Old Russian Man
12 Adversarial Exposure Validation Tools: The 2026 Buyer’s Verdict Guide
Microsoft Finds Hackers Using GSocket to Hide Linux Backdoors as Legitimate System Processes
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
