Skip to navigation

Threat reportVulnerabilityTL-2026-5830

Microsoft AI-Assisted Research Discloses 59 Linux Kernel Bug Reports (33 CVEs) Incl. 21-Year-Old cls_u32 Flaw CVE-2026-74544; Local Root LPE Exploits Confirmed for 8 CVEs

highMONITORING

Microsoft's FORGE Lab used an AI-driven scanner (MDASH) to find and report 59 upstream Linux kernel bugs, with 33 CVEs assigned and 24 rated High or above (CVSS v3.1 >= 7.0). Working local root privilege-escalation exploits were confirmed for eight CVEs in controlled lab environments, some needing non-default settings or disabled mitigations; the source does not state in-the-wild exploitation. First disclosed .

Key facts

IdentifiersTL-2026-5830, CVE-2026-74544, CVE-2026-64580, CVE-2026-98222, CVE-2026-64563, CVE-2026-64554, CVE-2026-74561, CVE-2026-74562, CVE-2026-89789, CVE-2026-98364
Also known asMDASH Linux kernel findings, FORGE Lab 59 Linux kernel bug reports
SeverityHIGH
CVSS7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
First disclosed
Affected productsLinux Linux kernel (net/sched cls_u32); Linux Linux kernel (lib/rhashtable, netlink diag, TIPC); Linux Linux kernel (net/ipv6 xfrm6); Linux Linux kernel (security/keys encrypted keys); Google Android (Linux kernel, SELinux enforcing; CVE-2026-64563)
ToolsMDASH
MITRE ATT&CK techniquesT1106 Native API, T1499.004 Endpoint Denial of Service: Application or System Exploitation, T1587.004 Develop Capabilities: Exploits, T1588.006 Obtain Capabilities: Vulnerabilities
MotivationUNKNOWN
Target sectorstechnology, cloud, telecoms, government administration, finance
Target regionsGlobal
Detection rules9 (1 shown free)
Sources12 cited sources

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5830 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Unprivileged tc u32 Filter Change Targeting cls_u32 (CVE-2026-74544) — Exploitation

Flags non-root users running tc to add, replace or change u32 classifier filters, often from inside unshare/nsenter-created namespaces. This is the only user-reachable trigger path for the unchecked tc_u32_sel.offshift copy in u32_change() in net/sched/cls_u32.c (CVE-2026-74544, present since 2.6.12; fix rejects offshift >= 16). Unprivileged users reach it through user/network namespaces.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1068, T1106, T1499.004
  • Data sources: sysmon_for_linux, index=linux sourcetype=sysmon:linux, DeviceProcessEvents
  • Severity: high
  • Confidence: high

Splunk SPL

index=linux sourcetype="sysmon:linux" EventCode=1 Image="*/tc" CommandLine="*filter*" CommandLine="*u32*" (CommandLine="* add *" OR CommandLine="* replace *" OR CommandLine="* change *") User!="root"
| eval ns_wrapped=if(match(ParentCommandLine,"(?i)unshare|nsenter|ip\s+netns"),"yes","no"), cve_ref="CVE-2026-74544 cls_u32 u32_change offshift"
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(ParentCommandLine) as parents by host User ns_wrapped cve_ref
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "tc" and ProcessCommandLine has "filter" and ProcessCommandLine has "u32"
| where ProcessCommandLine has_any ("add", "replace", "change")
| where AccountName != "root"
| extend NamespaceWrapped = InitiatingProcessCommandLine has_any ("unshare", "nsenter", "netns")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, NamespaceWrapped

Sigma

title: Unprivileged tc u32 Filter Change Reaching cls_u32 (CVE-2026-74544)
id: 8c1f6f0e-3a52-4b8e-9d7b-5b0e6a1c2d11
status: experimental
description: Detects a non-root user adding or changing a traffic-control u32 filter, the code path of the unvalidated offshift in u32_change() (CVE-2026-74544).
references:
    - https://www.microsoft.com/en-us/security/blog/2026/11/11/lessons-from-59-linux-kernel-bug-reports/
    - https://osv.dev/vulnerability/CVE-2026-64563
    - https://osv.dev/vulnerability/CVE-2026-74544
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.privilege-escalation
    - attack.t1068
    - attack.execution
    - attack.t1106
    - attack.impact
    - attack.t1499.004
    - cve.2026.74544
logsource:
    category: process_creation
    product: linux
detection:
    selection_img:
        Image|endswith: '/tc'
    selection_u32:
        CommandLine|contains|all:
            - 'filter'
            - 'u32'
    selection_op:
        CommandLine|contains:
            - ' add '
            - ' replace '
            - ' change '
    filter_root:
        User: 'root'
    condition: selection_img and selection_u32 and selection_op and not filter_root
falsepositives:
    - Network engineers testing tc u32 classifiers as a delegated non-root user
    - Container or lab tooling configuring QoS in a user namespace
level: high

Known false positives:

  • Network engineers testing tc u32 classifiers as a delegated non-root user
  • Container or lab tooling that configures QoS inside user namespaces

Tuning notes: Exclude known QoS automation accounts and service hosts. Raise priority when ns_wrapped=yes. Pair with kernel-fault detection (SPL-003). Patch to 6.1.191/6.6.160/6.12.114/6.18.57/7.1.8 or unload cls_u32 where unused.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Non-Standard Process Opening NETLINK_SOCK_DIAG Sockets (CVE-2026-64563) — Exploitation · unlock with TL Creds
  • Linux Kernel LPE PoC Retrieval or Build (FORGE Lab CVEs) — Exploit Staging · unlock with TL Creds
  • nsenter Joining PID 1 Namespaces — Container Escape After Kernel LPE · unlock with TL Creds
  • Non-Root keyctl Encrypted Key Creation (CVE-2026-98222) — Exploitation · unlock with TL Creds
  • Root Sets SUID/SGID Bit on File in Writable Path — Post-Exploitation Persistence · unlock with TL Creds
  • Unprivileged User+Network Namespace Creation (Precursor to Namespace-Reachable Kernel Bugs) · unlock with TL Creds
  • Root Shell Spawned from User-Writable Path (Kernel LPE Outcome, CVE-2026-64563 et al.) — Post-Exploitation · unlock with TL Creds
  • Kernel Fault Telemetry Naming Vulnerable Functions (CVE-2026-74544/64563/64580/98222) — Exploit Trigger Impact · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-5830.

Sample indicators (3 of 11)

  • File hash: 5d240a8936f6a1d3ece06701e8c4d830a2eca8a8
  • File hash: 8173f7e2ce67e6ca1d4763f3da14e5b01ce77456
  • File hash: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2

Defanged, TLP:CLEAR. Full set of 11 indicators: unlock with TL Creds.

11 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Between late May and mid-June 2026 Microsoft's FORGE Lab ran an AI-driven vulnerability scanner, codenamed MDASH, against Linux kernel networking, filesystem and security-module subsystems. Scanning produced 26,502 raw findings on two servers in about two weeks. Confidence filtering and screening agents reduced these to 11,769 candidates. PoC-generating agents then reproduced 621 cases in QEMU. After expert review (one full-time researcher and one intern), 59 were reported upstream; the first public report was on 2026-06-27. 266 of the 621 cases shared a root cause with another case, 163 were not reported (mostly limited security impact) and 133 were already reported or fixed upstream. The 59 reports yielded 33 CVEs, 24 of them rated High or above. Fixes for 38 reports reached mainline, with a median of 41 days from first public patch to mainline release (maximum 108). Reported bugs averaged 8.1 years old; six were 15-19 years old and three were at least 20 years old.

Working local root privilege-escalation exploits were confirmed in controlled labs for eight CVEs: CVE-2026-64554 (net/ipv6, use-after-free in bridged IPv6 fragmentation), CVE-2026-64563 (lib/rhashtable use-after-free), CVE-2026-64580 (net/ipv6 xfrm refcount underflow), CVE-2026-74561 and CVE-2026-74562 (net/ipv4 next-hop replacement use-after-free from walking an IPv6 route list without a lock), CVE-2026-89789 (GTP driver use-after-free after failed device creation), CVE-2026-98222 (security/keys encrypted-key heap buffer overflow from a 16-bit length overflow) and CVE-2026-98364 (net/xfrm use-after-free from a netdevice used without a reference). Some of the exploits required non-default settings or disabled exploit mitigations; the sources do not say which.

CVE-2026-74544 is a shift-out-of-bounds in the net/sched cls_u32 classifier. u32_change() copies the user-supplied tc_u32_sel.offshift without a bounds check, and the flaw is reachable by unprivileged users through user/network namespaces. It was introduced in the original 2.6.12 tree (commit 1da177e4c3f4) and the fix rejects offshift >= 16. Microsoft cites it as the oldest bug, present for at least 21 years. It is not in the list of eight exploited CVEs. CVE-2026-64580 is a double netdev_put() in xfrm6_fill_dst() on the in6_dev_get() failure path, leaving dst.dev set so dst_destroy() underflows the refcount. CVE-2026-98222 is an integer overflow of datablob_len (u16) in encrypted_key_alloc(), giving a slab out-of-bounds write (KASAN reported 32760 bytes).

CVE-2026-64563 gets the deepest analysis. A 2018 commit (5d240a8936f6) stopped clearing iter->p in rhashtable_walk_stop() and moved the reset into rhashtable_walk_start_check(), but only on one of two resume paths. If a resize frees the old bucket table during a pause, the function returns -EAGAIN with iter->p still set, so rhashtable_walk_next() follows iter->p->next into freed memory. The exploitable caller is __netlink_diag_dump(), where an unprivileged user controls the pause via recvmsg(). The attacker resizes the table, frees the socket at iter->p, and reallocates that memory so iter->p->next yields a fake socket. The fake sk passes the net_eq() check and reaches sk_diag_fill() and sock_diag_save_cookie(), which initializes sk->sk_cookie if zero. That gives a constrained 64-bit write (the target bytes must be zero and sk->sk_net must match &init_net). Combined with other techniques, this gives stable LPE without special kernel configs or user namespaces, and it also affected Android with SELinux enforcing. TIPC's tipc_nl_sk_walk() is the other pause/resume caller but is not exploitable (it can at least crash). NebuSec researchers Yuan Tan and Frank Wu independently found the bug and provided working Linux and Android exploits.

The sources state no in-the-wild exploitation, threat actor, malware or network IOCs. The IOC list below therefore holds defender-relevant artifacts (kernel modules, source paths, vulnerable functions, fix commits, tooling and entities) rather than adversary infrastructure. The Microsoft post says discovery now outpaces remediation, because human review and maintainer capacity are the bottleneck. Defenders should patch to the fixed stable kernels and treat the affected subsystems as local privilege-escalation surface on multi-user hosts, containers and Android devices.

MITRE ATT&CK techniques by tactic:

Execution

T1106 Native API

Impact

T1499.004 Endpoint Denial of Service: Application or System Exploitation

Resource Development

T1587.004 Develop Capabilities: Exploits; T1588.006 Obtain Capabilities: Vulnerabilities

Remediation

Patches

  • Upstream fix for CVE-2026-64563: commit 8173f7e2ce67e6ca1d4763f3da14e5b01ce77456 (sets iter->p = NULL)
  • CVE-2026-74544: reject offshift >= 16 in u32_change()
  • CVE-2026-64580: clear xdst->u.dst.dev after netdev_put() in xfrm6_fill_dst()
  • CVE-2026-98222: check_add_overflow() on datablob_len in encrypted_key_alloc()

Immediate actions

  • Update to a kernel containing the upstream stable fixes: CVE-2026-64563 fixed in 5.10.265, 5.15.216, 6.1.183, 6.6.151, 6.12.103, 6.18.42 and 7.1.6; CVE-2026-64580 fixed in 6.1.183, 6.6.148, 6.12.101, 6.18.42 and 7.1.6; CVE-2026-74544 fixed in 6.1.191, 6.6.160, 6.12.114, 6.18.57 and 7.1.8; CVE-2026-98222 fixed in 6.12.112, 6.18.54 and 7.2.8 (per OSV)
  • Prioritize multi-user hosts, container hosts and Android devices, where local unprivileged code execution is realistic
  • Check distribution advisories (Red Hat, Debian, Amazon Linux, Oracle, Rocky) for backported fixes, since some vendors still list fixes as pending

Workarounds

  • For CVE-2026-74544, unload the cls_u32 module or disable u32 traffic-control filters in affected network namespaces until patched (suggested by OpenCVE)

Longer-term hardening

  • Track the FORGE Lab CVE list (github.com/microsoft/forge-lab) and upstream lore.kernel.org reports for the remaining CVEs
  • Keep exploit mitigations (KASLR, SMEP/SMAP, hardened usercopy, SELinux enforcing) enabled, because some lab exploits needed them disabled
  • Restrict unprivileged user namespaces where not needed
  • Monitor for unexpected privilege transitions from unprivileged processes on Linux endpoints

Affected and fixed versions

  • Linux — Linux kernel (net/sched cls_u32)
    Vulnerable versions: 2.6.12 up to but not including 6.1.191, 6.6.160, 6.12.114, 6.18.57, 7.1.8 (CVE-2026-74544)
    Fixed in: 6.1.191; 6.6.160; 6.12.114; 6.18.57; 7.1.8
  • Linux — Linux kernel (lib/rhashtable, netlink diag, TIPC)
    Vulnerable versions: 4.18.0 up to the per-branch fixed releases (CVE-2026-64563)
    Fixed in: 5.10.265; 5.15.216; 6.1.183; 6.6.151; 6.12.103; 6.18.42; 7.1.6
  • Linux — Linux kernel (net/ipv6 xfrm6)
    Vulnerable versions: 3.10.0 up to the per-branch fixed releases (CVE-2026-64580)
    Fixed in: 6.1.183; 6.6.148; 6.12.101; 6.18.42; 7.1.6
  • Linux — Linux kernel (security/keys encrypted keys)
    Vulnerable versions: 2.6.38 up to the per-branch fixed releases (CVE-2026-98222)
    Fixed in: 6.12.112; 6.18.54; 7.2.8
  • Google — Android (Linux kernel, SELinux enforcing; CVE-2026-64563)
    Vulnerable versions: Not specified in source

Timeline

  • First public upstream Linux kernel report from the MDASH scanning effort, following scanning that began in late May 2026
  • CVE-2026-64563 (rhashtable use-after-free, CVSS 7.8) published
  • CVE-2026-64580 (xfrm6 refcount underflow, CVSS 7.8) published
  • CVE-2026-74544 (cls_u32 shift-out-of-bounds, present since 2.6.12, CVSS 7.8) published
  • 55 of the 59 reports posted publicly; the other four were reported privately and routed to public lists by mid-October
  • CVE-2026-98222 (encrypted-keys heap buffer overflow) published
  • Microsoft Security Blog publishes 'Lessons from 59 Linux kernel bug reports': 33 CVEs, 24 rated High or above, local root exploits confirmed for 8 CVEs
  • GBHackers reports the findings, including the 21-year-old cls_u32 bug

Sources cited

Drafted by the Threadlinqs research pipeline from 12 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats