Microsoft's AI agents help find 59 Linux kernel bugs, some hidden for more than 20 years
Microsoft's FORGE Lab project MDASH produced 26,502 potential findings in about two weeks, screened to 11,769 candidates and 59 upstream reports; researchers built root exploits for eight CVEs and 38 fixes are merged, but validation and patching stayed mostly human work.
Why it matters
Microsoft's results suggest AI agents can sharply widen the search for kernel flaws: tens of thousands of raw findings came out of two weeks of scanning networking, filesystem and security-module code. The work that followed, validating bugs, testing exploits, writing patches and working with maintainers, still fell mainly on human researchers. That shifts the bottleneck from finding candidate bugs to confirming them and getting fixes accepted upstream. Microsoft says fixes for 38 of its 59 reports are already merged into mainline. Watch whether the remaining reports are patched and how quickly.
Key facts
- 26,502 potential findings in about two weeks
- 11,769 candidates after automated screening
- 59 public upstream bug reports
- Working root exploits for eight CVEs
- Fixes for 38 reports merged into mainline
- Some bugs dated back more than 20 years