[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCsD8d4fYqhdEpEH00TX4230_OuVP2rk-lmd5zQHNrME":3},{"article":4,"iocs":46,"watch_terms":54,"solutions":55,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"4bcc6634-9cb3-4c5d-ac7b-2007c832da05","Microsoft Discovers 59 Linux Kernel Security Bugs Using AI, Including Flaws Hidden for Over 20 Years","microsoft-discovers-59-linux-kernel-security-bugs-using-ai-including-flaws-hidde-4ec823","Microsoft’s FORGE Lab used an AI-driven scanning system to find 59 security bugs in the Linux kernel. Some of them sat unnoticed for more than 20 years. The work has so far led to 33 assigned CVEs, and Microsoft confirmed working root privilege-escalation exploits for eight of them. The team used a tool with the […] The post Microsoft Discovers 59 Linux Kernel Security Bugs Using AI, Including Flaws Hidden for Over 20 Years appeared first on Cyber Security News.","Microsoft's FORGE Lab utilized an AI-driven system called MDASH to identify 59 security vulnerabilities within the Linux kernel, with some flaws remaining undetected for over two decades. This effort has resulted in 33 assigned CVEs, and Microsoft has confirmed the existence of root privilege-escalation exploits for eight of these vulnerabilities. While AI significantly aided in bug discovery, the process highlighted the substantial human effort required for confirmation, explanation, and remediation.","Microsoft AI finds 59 Linux kernel bugs, some over 20 years old, with 8 confirmed exploits.","https:\u002F\u002Fcybersecuritynews.com\u002Flinux-kernel-security-bugs\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FMicrosoft-Discovers-59-Linux-Kernel-Security-Bugs-Using-AI-Including-Flaws-Hidden-for-Over-20-Years.webp","2026-11-12T07:24:12+00:00","2026-11-12T08:00:42.339097+00:00",8,[17,20,23,26],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Linux kernel","technology",{"name":24,"type":25},"MDASH","product",{"name":27,"type":22},"AI","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,36,41],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,51],{"type":48,"value":49,"context":50},"cve","CVE-2026-74544","Oldest identified Linux kernel bug, a cls_u32 shift-out-of-bounds bug.",{"type":48,"value":52,"context":53},"CVE-2026-64563","A one-line bug in rhashtable, the kernel’s shared resizable hash table, with a confirmed local root exploit.",[18,24],{"controls":56,"vendors":142},[57,86,114],{"slug":58,"name":59,"problem":60,"products":61},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":87,"name":88,"problem":89,"products":90},"patch-management","Automated patch management","Known holes get closed in days, not months.",[91,98,106],{"vendor_slug":92,"vendor_name":18,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":45,"name":115,"problem":116,"products":117},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[143],{"slug":92,"name":18,"logo_path":93,"roles":144},[145],"reported_by",{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":156},"ai-uncovers-59-linux-kernel-bugs-some-hidden-for-20-years","AI Uncovers 59 Linux Kernel Bugs, Some Hidden for 20+ Years","Microsoft's FORGE Lab used an AI-powered tool called MDASH to surface 59 security vulnerabilities in the Linux kernel, including flaws that evaded detection for over two decades. Eight of these vulnerabilities have confirmed root privilege-escalation exploits, meaning attackers could gain full system control if left unpatched. The discovery highlights a critical gap in traditional vulnerability management: manual code review and conventional static analysis tools are insufficient to find deeply embedded flaws in complex, long-lived codebases. As software ages, its attack surface compounds quietly — vulnerabilities accumulate faster than human reviewers can audit them. This case underscores the urgent need for continuous, automated vulnerability discovery as a standard part of the software development and maintenance lifecycle.",[151,152,153,154,155],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 ID.RA-1: Asset Vulnerabilities Identified and Documented","NIS2 Article 21(2)(e)","NIST SP 800-53 SA-11: Developer Testing and Evaluation",{"NIS2 Article 21(2)(e)":157,"NIST SP 800-53 SI-2: Flaw Remediation":158,"NIST SP 800-53 SA-11: Developer Testing and Evaluation":159,"CIS Control 7: Continuous Vulnerability Management (v8)":160,"NIST CSF 2.0 ID.RA-1: Asset Vulnerabilities Identified and Documented":161},"This provision requires security in acquisition, development, and maintenance including vulnerability handling and disclosure, which covers the obligation to proactively find and remediate vulnerabilities like these long-hidden kernel flaws.","SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner, which directly applies to remediating the 33 CVEs now assigned to these kernel vulnerabilities.","SA-11 requires the use of security testing and analysis during development, and adopting AI-augmented code analysis tools such as MDASH directly fulfills this control to find vulnerabilities before software reaches production.","This control requires organizations to continuously assess and remediate vulnerabilities — exactly the practice that would have surfaced these long-dormant Linux kernel flaws before they could be exploited.","This category calls for systematic identification of vulnerabilities in organizational assets — the very activity Microsoft's MDASH tool performed and that organizations running Linux must now operationalize for themselves."]