Skip to content
Microsoft Discovers 59 Linux Kernel Vulnerabilities, Some Unnoticed for 21 Years

Microsoft Discovers 59 Linux Kernel Vulnerabilities, Some Unnoticed for 21 Years

First seen 12 Nov 2026, 05:19 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 12, 2026 at 11:51 UTC
  • •59 vulnerabilities discovered in Linux kernel, with 33 assigned CVEs.
  • •CVE-2026-74544 remained unnoticed for over 21 years.
  • •Eight CVEs confirmed to have local root privilege escalation exploits.

Microsoft's FORGE Lab utilized an AI-driven scanning tool, codenamed MDASH, to identify 59 security vulnerabilities in the Linux kernel, resulting in 33 assigned CVEs. Among these, CVE-2026-74544, a cls_u32 shift-out-of-bounds flaw, had remained undetected for over 21 years. The scanning process generated 26,502 findings, which were narrowed down to 621 cases with proof-of-concept evidence. Eight of the CVEs have confirmed local root privilege escalation exploits, with fixes for 38 vulnerabilities merged into the mainline. The average age of the discovered bugs was 8.1 years, with some dating back 20 years or more. The review and merging of fixes took several months, highlighting a bottleneck in the vulnerability management process. Upstream Linux requires a working patch with each report, complicating the submission process.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1h ago How this analysis works

Timeline

2026-08-04
CVE-2026-64563 published
A one-line state-reset bug in rhashtable was published, with a CVSS score of 7.8.
Gbhackers
2026-08-05
CVE-2026-64580 published
A refcount underflow vulnerability was disclosed, also rated at 7.8.
Gbhackers
2026-08-15
CVE-2026-74544 published
A cls_u32 shift-out-of-bounds flaw was disclosed, having gone unnoticed for 21 years.
Gbhackers
2026-10-06
CVE-2026-98222 published
A heap buffer overflow in encrypted-key updates was disclosed.
Gbhackers

More articles in this cluster (8)

Following this threat?

Track Qilin and CVE-2026-64563 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (17)

1 / 4

Common questions

Which CVEs are confirmed to have exploits?
Eight CVEs have confirmed local root privilege escalation exploits, including CVE-2026-64563 and CVE-2026-74544.
How long did it take to merge fixes?
The review and merging of fixes took several months after the initial scans were completed.
What tools were used in the scanning process?
The scanning primarily utilized Sonnet 4.6, GPT-5.4, and GPT-5.5.