Microsoft Publishes MDASH Results: 59 Linux Kernel Bug Reports

Microsoft’s MDASH research produced 59 Linux kernel bug reports, which the company’s researchers submitted to upstream developers. Microsoft said 33 findings have already received CVE identifiers, and fixes for 38 reports were merged into the kernel’s mainline branch.

The project was conducted by Microsoft FORGE Lab from late May to mid-June 2026. It combined automated scanning with manual validation of findings and collaboration with maintainers of individual kernel components. According to Microsoft, automation helped identify candidate issues, but reproduction, impact assessment, and preparing fixes remained a substantial part of the work.

Microsoft’s MDASH Research and Local Privilege Escalations

Microsoft confirmed functional local privilege escalations to root for eight CVEs under controlled laboratory conditions. This is a scenario in which an attacker or malicious process already has local system access and attempts to obtain higher privileges.

The company also noted that some demonstrations required nonstandard configurations or disabled security mitigations. A laboratory proof of concept therefore does not by itself indicate confirmed attacks against users or exploitation in the wild. Such exploitation of the vulnerabilities mentioned was not confirmed in the available materials.

Confirmed Fix for CVE-2026-64563

One specifically documented finding is CVE-2026-64563. A commit in the torvalds/linux repository confirms a fix for a use-after-free bug in the rhashtable implementation. The issue occurred when resuming iteration after the table had changed.

Use-after-free refers to a class of bug in which code accesses memory after it has been freed. Depending on the specific code and conditions, such a bug may lead to a system crash, data integrity issues, or a security problem. In the case of CVE-2026-64563, the upstream commit cites a report from Microsoft and links to the relevant CVE.

What Linux Administrators Should Monitor

For Linux system administrators and device manufacturers, it is relevant to monitor security advisories from specific distributions and available kernel updates. Based on the available information, it is not possible to confirm which distributions, kernel versions, or Android builds already contain backported fixes for all 33 CVEs.

This is especially true for environments where the kernel is updated separately from the rest of the system or where a manufacturer maintains its own branch with backported patches. An upstream fix merge does not automatically mean immediate availability in every supported product.

• monitor advisories from the distribution or device manufacturer,
• deploy available kernel updates according to operational procedures,
• verify the status of specific CVEs in the kernel branch used in your environment,
• watch for information about fixes for the remaining 21 reports.

The totals of 59 reports, 33 CVEs, and 38 merged fixes currently come primarily from Microsoft’s statement; a complete independent review of the entire set was not available. Further developments will be shown by distribution and Android vendor security advisories, as well as any credible reports of exploitation outside laboratory environments.

Verified and updated: November 12, 2026 15:21