[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBULUul_w41uSMnzjmAC3ZS-4skOhuT136sI5ajhW1EU":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"a9df7f4c-10fc-4ba0-8f57-37da52f44370","Lessons from 59 Linux Kernel Bug Reports","lessons-from-59-linux-kernel-bug-reports-37d277","Microsoft FORGE Lab researchers used codename MDASH to investigate Linux kernel vulnerabilities, resulting in 59 upstream bug reports, 33 assigned CVEs, and 38 merged fixes. The research includes eight demonstrated local root privilege-escalation exploits and examines the challenges of turning AI-generated findings into validated vulnerabilities and upstream fixes. The post Lessons from 59 Linux Kernel Bug Reports appeared first on Microsoft Security Blog.","Microsoft's FORGE Lab used a tool codenamed MDASH to scan Linux kernel subsystems, identifying 59 upstream bug reports and assigning 33 CVEs. Eight of these vulnerabilities were demonstrated as local root privilege-escalation exploits, and fixes for 38 reports have been merged into the mainline kernel. The research highlights the challenges of converting AI-generated findings into validated vulnerabilities and upstream fixes, noting that the average bug discovered was over 8 years old.","Microsoft FORGE Lab researchers found 59 Linux kernel bugs, 33 CVEs, and 8 privilege-escalation exploits.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F11\u002F11\u002Flessons-from-59-linux-kernel-bug-reports\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F03\u002FMS_Actional-Insights_Malware-ransomware-1.jpg","2026-11-11T16:55:00+00:00","2026-11-11T19:00:12.937842+00:00",8,[17,20,23],{"name":18,"type":19},"Linux kernel","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":25},"AI","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,34,39],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,18],{"controls":47,"vendors":132},[48,77,104],{"slug":49,"name":50,"problem":51,"products":52},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[53,61,69],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":78,"name":79,"problem":80,"products":81},"patch-management","Automated patch management","Known holes get closed in days, not months.",[82,89,96],{"vendor_slug":83,"vendor_name":21,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":78,"product_name":93,"url":94,"description":95},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":43,"name":105,"problem":106,"products":107},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[108,116,124],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",[133],{"slug":83,"name":21,"logo_path":84,"roles":134},[135],"reported_by",{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":146},"decade-old-linux-kernel-bugs-highlight-the-depth-of-undetected-vulnerability-debt","Decade-Old Linux Kernel Bugs Highlight the Depth of Undetected Vulnerability Debt","Microsoft's FORGE Lab discovered 59 bugs in the Linux kernel, many averaging over 8 years old, including eight that could be exploited for local root privilege escalation. This demonstrates that even widely scrutinized open-source codebases can harbor long-lived, high-severity vulnerabilities that evade traditional review processes. The challenge of converting AI-generated findings into validated CVEs and upstream fixes illustrates the complexity of modern vulnerability management pipelines. Organizations relying on the Linux kernel—whether in servers, containers, or embedded systems—face real exposure until patches are merged, backported, and deployed.",[141,142,143,144,145],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 ID.RA-1: Asset vulnerabilities are identified and documented","NIS2 Article 21(2)(e)","MITRE ATT&CK T1068: Exploitation for Privilege Escalation",{"NIS2 Article 21(2)(e)":147,"NIST SP 800-53 SI-2: Flaw Remediation":148,"CIS Control 7: Continuous Vulnerability Management (v8)":149,"MITRE ATT&CK T1068: Exploitation for Privilege Escalation":150,"NIST CSF 2.0 ID.RA-1: Asset vulnerabilities are identified and documented":151},"This point covers vulnerability handling and disclosure in acquisition, development, and maintenance, directly applicable to the need for systematic tracking and patching of discovered kernel CVEs.","SI-2 requires organizations to identify, report, and correct information system flaws; the decade-long existence of these bugs reflects a gap in systematic flaw identification for open-source kernel components.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities; a structured scanning program would have identified these 8+ year-old kernel bugs far sooner.","Eight of the discovered vulnerabilities were demonstrated as local root privilege-escalation exploits, matching exactly the technique ATT&CK T1068 describes and that defenders should monitor for.","This category directly calls for identifying vulnerabilities in assets; organizations running Linux kernels without proactive scanning failed to identify these long-standing privilege-escalation flaws."]