Microsoft’s FORGE Lab reported 59 public vulnerability reports from an AI-assisted scan of selected Linux kernel subsystems, including flaws that had persisted for more than 20 years. In roughly two weeks, the project generated 26,502 candidate findings.
Automated screening narrowed the candidates, then AI agents tried to reproduce likely bugs in an emulated Linux system; 621 cases produced proof-of-concept evidence for human review. Microsoft researchers traced root causes, merged duplicates and prepared upstream reports, leaving 59 public reports. They developed working root-privilege-escalation exploits for eight; fixes for 38 reports have reached mainline. Some exploit demonstrations required non-default settings or disabled mitigations.
The funnel shows AI expanding discovery while people still establish which findings are security flaws and move them through upstream reporting and patching. For kernel maintainers and distributors, a faster stream of credible findings may increase triage and backport pressure; the report does not show that fixes or deployed updates are arriving faster.
CVSS 7.8 HIGH: in the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_u32: validate offshift to prevent… EPSS 0.1% (3rd percentile). Microsoft patch: Release Notes.
AI found Linux kernel bugs that remained undetected for decades
AI-assisted scanning identified thousands of potential flaws in weeks, leading to 59 validated bug reports, eight working root exploits, and vulnerabilities dating back more than 20 years.