Microsoft AI Uncovers 21-Year-Old Linux Kernel Vulnerability Among 59 Security Issues
Microsoft deployed an AI-driven scanning system, MDASH, to analyze critical Linux kernel subsystems, discovering 59 security issues, including 33 assigned CVEs. Notably, a 21-year-old shift-out-of-bounds vulnerability in the cls_u32 component (CVE-2026-74544) had gone unnoticed until this effort. The AI-assisted process involved initial detection by models like Sonnet 4.6 and GPT-5.x, followed by proof-of-concept reproduction in QEMU, and human expert validation. Of the CVEs, 24 are rated High or above, with confirmed local root exploits for eight vulnerabilities, mainly use-after-free flaws. One detailed case, CVE-2026-64563, involves a state-reset bug in rhashtable enabling local privilege escalation via a rare sequence of events. While 38 fixes have reached Linux mainline, the report highlights that human review remains the bottleneck in patch integration, and ongoing prioritization of high-severity findings is vital to maintain kernel security.
Entenda a falha
A vulnerabilidade
The story covers four Linux kernel CVEs from Microsoft's MDASH scan, which found 59 issues and 33 CVEs in total. CVE-2026-64563 is a state-reset bug in lib/rhashtable that leads to use-after-free and local privilege escalation. An unprivileged local user can reach it through netlink_diag_dump() on standard kernels, and Android with SELinux enforcing is also affected. CVE-2026-98222 is a heap buffer overflow in encrypted-key updates, and CVE-2026-64580 is a refcount underflow. Some of the exploits need non-default settings or disabled mitigations. CVE-2026-74544 is a shift-out-of-bounds in cls_u32 that went unnoticed for at least 21 years. The articles give no CVSS scores per CVE and no affected or fixed version numbers. They say only that 38 fixes have reached mainline.
Como funciona
In CVE-2026-64563, rhashtable is the kernel's shared resizable hash table, and callers walk it with an iterator that can be paused and resumed. On resume, rhashtable_walk_start_check() decides how to continue. If a resize has freed the old table, it returns -EAGAIN, but the iterator pointer iter->p still points at an entry. The next walk step then follows a pointer to an entry that may already be freed. Netlink diag dumping via netlink_diag_dump() uses this walk, and the user controls when it pauses through recvmsg(). The articles say sock_diag_save_cookie() then performs a constrained 64-bit write on the freed socket's memory, which is enough for privilege escalation. The other CVEs' mechanisms are not detailed.
Por que é vulnerável
For CVE-2026-64563 the cause is an incomplete state reset. A 2018 commit moved the clearing of iter->p into rhashtable_walk_start_check(), but only on one of its two resume paths, so the other path left a stale pointer. Exploitation needs three events to coincide: a paused and resumed iterator, a resize that frees the old table, and removal of the entry at iter->p. That rarity explains why it survived about eight years. The upstream fix is a single line, iter->p = NULL. The articles give no root-cause detail for the other CVEs beyond their bug classes. Across the whole effort, the bugs averaged 8.1 years old at first public report.
Onde está
For CVE-2026-64563: rhashtable_walk_start_check() in lib/rhashtable, introduced by commit 5d240a8936f6 (2018), reached through netlink_diag_dump() and sock_diag_save_cookie(). CVE-2026-74544 is in the cls_u32 component, and CVE-2026-98222 is in encrypted-key updates (security/keys).
Como foi descoberta
The flaws were found by Microsoft's AI-driven MDASH system, run by one full-time researcher and one intern on selected kernel subsystems from late May to mid-June 2026. Models such as Sonnet 4.6, GPT-5.4 and GPT-5.5 produced 26,502 raw findings. Filtering cut these to 11,769 candidates, and PoC-generating agents reproduced them in QEMU, leaving 621 cases. Human experts then reviewed those, and 59 became public upstream reports. Agents drafted fixes and humans validated them. For CVE-2026-64563, NebuSec researchers Yuan Tan and Frank Wu independently found the bug.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
PoC agents reproduced candidate bugs in QEMU, and working local root privilege-escalation exploits were confirmed for eight CVEs, mostly use-after-free flaws across net/ipv6, net/ipv4, lib/rhashtable, the GTP driver, security/keys and net/xfrm. For CVE-2026-64563, the NebuSec researchers Yuan Tan and Frank Wu contributed working exploits. The articles do not say any exploit was published, so access is treated as private. Because working root exploits exist, patching the high-severity kernel fixes is urgent for multi-user and exposed systems.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 03:15.
Linha do tempo
-
Microsoft AI Uncovers 21-Year-Old Linux Kernel Vulnerability Among 59 Security Issues
ler a análise desta fonte ocultar
Microsoft deployed an AI-driven scanning system, MDASH, to analyze critical Linux kernel subsystems, discovering 59 security issues, including 33 assigned CVEs. Notably, a 21-year-old shift-out-of-bounds vulnerability in the cls_u32 component (CVE-2026-74544) had gone unnoticed until this effort. The AI-assisted process involved initial detection by models like Sonnet 4.6 and GPT-5.x, followed by proof-of-concept reproduction in QEMU, and human expert validation. Of the CVEs, 24 are rated High or above, with confirmed local root exploits for eight vulnerabilities, mainly use-after-free flaws. One detailed case, CVE-2026-64563, involves a state-reset bug in rhashtable enabling local privilege escalation via a rare sequence of events. While 38 fixes have reached Linux mainline, the report highlights that human review remains the bottleneck in patch integration, and ongoing prioritization of high-severity findings is vital to maintain kernel security.