# Microsoft AI-Assisted Research Discloses 59 Linux Kernel Bug Reports (33 CVEs) Incl. 21-Year-Old cls_u32 Flaw CVE-2026-74544; Local Root LPE Exploits Confirmed for 8 CVEs

> Microsoft's FORGE Lab used an AI-driven scanner (MDASH) to find and report 59 upstream Linux kernel bugs, with 33 CVEs assigned and 24 rated High or above (CVSS v3.1 >= 7.0). Working local root privilege-escalation exploits were confirmed for eight CVEs in controlled lab environments, some needing non-default settings or disabled mitigations; the source does not state in-the-wild exploitation.

- **Published:** 2026-11-12T06:05:57Z
- **Last reviewed:** 2026-11-12T06:05:57Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5830
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5830.png
- **ID:** TL-2026-5830
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 11 (3 shown free below)
- **CVEs:** CVE-2026-74544, CVE-2026-64580, CVE-2026-98222, CVE-2026-64563, CVE-2026-64554, CVE-2026-74561, CVE-2026-74562, CVE-2026-89789, CVE-2026-98364

## Description

Between late May and mid-June 2026 Microsoft's FORGE Lab ran an AI-driven vulnerability scanner, codenamed MDASH, against Linux kernel networking, filesystem and security-module subsystems. Scanning produced 26,502 raw findings on two servers in about two weeks. Confidence filtering and screening agents reduced these to 11,769 candidates. PoC-generating agents then reproduced 621 cases in QEMU. After expert review (one full-time researcher and one intern), 59 were reported upstream; the first public report was on 2026-06-27. 266 of the 621 cases shared a root cause with another case, 163 were not reported (mostly limited security impact) and 133 were already reported or fixed upstream. The 59 reports yielded 33 CVEs, 24 of them rated High or above. Fixes for 38 reports reached mainline, with a median of 41 days from first public patch to mainline release (maximum 108). Reported bugs averaged 8.1 years old; six were 15-19 years old and three were at least 20 years old.

Working local root privilege-escalation exploits were confirmed in controlled labs for eight CVEs: CVE-2026-64554 (net/ipv6, use-after-free in bridged IPv6 fragmentation), CVE-2026-64563 (lib/rhashtable use-after-free), CVE-2026-64580 (net/ipv6 xfrm refcount underflow), CVE-2026-74561 and CVE-2026-74562 (net/ipv4 next-hop replacement use-after-free from walking an IPv6 route list without a lock), CVE-2026-89789 (GTP driver use-after-free after failed device creation), CVE-2026-98222 (security/keys encrypted-key heap buffer overflow from a 16-bit length overflow) and CVE-2026-98364 (net/xfrm use-after-free from a netdevice used without a reference). Some of the exploits required non-default settings or disabled exploit mitigations; the sources do not say which.

CVE-2026-74544 is a shift-out-of-bounds in the net/sched cls_u32 classifier. u32_change() copies the user-supplied tc_u32_sel.offshift without a bounds check, and the flaw is reachable by unprivileged users through user/network namespaces. It was introduced in the original 2.6.12 tree (commit 1da177e4c3f4) and the fix rejects offshift >= 16. Microsoft cites it as the oldest bug, present for at least 21 years. It is not in the list of eight exploited CVEs. CVE-2026-64580 is a double netdev_put() in xfrm6_fill_dst() on the in6_dev_get() failure path, leaving dst.dev set so dst_destroy() underflows the refcount. CVE-2026-98222 is an integer overflow of datablob_len (u16) in encrypted_key_alloc(), giving a slab out-of-bounds write (KASAN reported 32760 bytes).

CVE-2026-64563 gets the deepest analysis. A 2018 commit (5d240a8936f6) stopped clearing iter->p in rhashtable_walk_stop() and moved the reset into rhashtable_walk_start_check(), but only on one of two resume paths. If a resize frees the old bucket table during a pause, the function returns -EAGAIN with iter->p still set, so rhashtable_walk_next() follows iter->p->next into freed memory. The exploitable caller is __netlink_diag_dump(), where an unprivileged user controls the pause via recvmsg(). The attacker resizes the table, frees the socket at iter->p, and reallocates that memory so iter->p->next yields a fake socket. The fake sk passes the net_eq() check and reaches sk_diag_fill() and sock_diag_save_cookie(), which initializes sk->sk_cookie if zero. That gives a constrained 64-bit write (the target bytes must be zero and sk->sk_net must match &init_net). Combined with other techniques, this gives stable LPE without special kernel configs or user namespaces, and it also affected Android with SELinux enforcing. TIPC's tipc_nl_sk_walk() is the other pause/resume caller but is not exploitable (it can at least crash). NebuSec researchers Yuan Tan and Frank Wu independently found the bug and provided working Linux and Android exploits.

The sources state no in-the-wild exploitation, threat actor, malware or network IOCs. The IOC list below therefore holds defender-relevant artifacts (kernel modules, source paths, vulnerable functions, fix commits, tooling and entities) rather than adversary infrastructure. The Microsoft post says discovery now outpaces remediation, because human review and maintainer capacity are the bottleneck. Defenders should patch to the fixed stable kernels and treat the affected subsystems as local privilege-escalation surface on multi-user hosts, containers and Android devices.

## MITRE ATT&CK

- T1106 Native API
- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T1587.004 Develop Capabilities: Exploits
- T1588.006 Obtain Capabilities: Vulnerabilities

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Unprivileged tc u32 Filter Change Targeting cls_u32 (CVE-2026-74544) — Exploitation** (`TL-2026-5830-SPL-001`)

Flags non-root users running tc to add, replace or change u32 classifier filters, often from inside unshare/nsenter-created namespaces. This is the only user-reachable trigger path for the unchecked tc_u32_sel.offshift copy in u32_change() in net/sched/cls_u32.c (CVE-2026-74544, present since 2.6.12; fix rejects offshift >= 16). Unprivileged users reach it through user/network namespaces.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1068, T1106, T1499.004
- **Data sources:** sysmon_for_linux, index=linux sourcetype=sysmon:linux, DeviceProcessEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=linux sourcetype="sysmon:linux" EventCode=1 Image="*/tc" CommandLine="*filter*" CommandLine="*u32*" (CommandLine="* add *" OR CommandLine="* replace *" OR CommandLine="* change *") User!="root"
| eval ns_wrapped=if(match(ParentCommandLine,"(?i)unshare|nsenter|ip\s+netns"),"yes","no"), cve_ref="CVE-2026-74544 cls_u32 u32_change offshift"
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(ParentCommandLine) as parents by host User ns_wrapped cve_ref
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "tc" and ProcessCommandLine has "filter" and ProcessCommandLine has "u32"
| where ProcessCommandLine has_any ("add", "replace", "change")
| where AccountName != "root"
| extend NamespaceWrapped = InitiatingProcessCommandLine has_any ("unshare", "nsenter", "netns")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, NamespaceWrapped
```

### Sigma

```yaml
title: Unprivileged tc u32 Filter Change Reaching cls_u32 (CVE-2026-74544)
id: 8c1f6f0e-3a52-4b8e-9d7b-5b0e6a1c2d11
status: experimental
description: Detects a non-root user adding or changing a traffic-control u32 filter, the code path of the unvalidated offshift in u32_change() (CVE-2026-74544).
references:
    - https://www.microsoft.com/en-us/security/blog/2026/11/11/lessons-from-59-linux-kernel-bug-reports/
    - https://osv.dev/vulnerability/CVE-2026-64563
    - https://osv.dev/vulnerability/CVE-2026-74544
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.privilege-escalation
    - attack.t1068
    - attack.execution
    - attack.t1106
    - attack.impact
    - attack.t1499.004
    - cve.2026.74544
logsource:
    category: process_creation
    product: linux
detection:
    selection_img:
        Image|endswith: '/tc'
    selection_u32:
        CommandLine|contains|all:
            - 'filter'
            - 'u32'
    selection_op:
        CommandLine|contains:
            - ' add '
            - ' replace '
            - ' change '
    filter_root:
        User: 'root'
    condition: selection_img and selection_u32 and selection_op and not filter_root
falsepositives:
    - Network engineers testing tc u32 classifiers as a delegated non-root user
    - Container or lab tooling configuring QoS in a user namespace
level: high

```

**Known false positives:**

- Network engineers testing tc u32 classifiers as a delegated non-root user
- Container or lab tooling that configures QoS inside user namespaces

**Tuning notes:** Exclude known QoS automation accounts and service hosts. Raise priority when ns_wrapped=yes. Pair with kernel-fault detection (SPL-003). Patch to 6.1.191/6.6.160/6.12.114/6.18.57/7.1.8 or unload cls_u32 where unused.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Non-Standard Process Opening NETLINK_SOCK_DIAG Sockets (CVE-2026-64563) — Exploitation (locked: unlock with TL Creds)
- Linux Kernel LPE PoC Retrieval or Build (FORGE Lab CVEs) — Exploit Staging (locked: unlock with TL Creds)
- nsenter Joining PID 1 Namespaces — Container Escape After Kernel LPE (locked: unlock with TL Creds)
- Non-Root keyctl Encrypted Key Creation (CVE-2026-98222) — Exploitation (locked: unlock with TL Creds)
- Root Sets SUID/SGID Bit on File in Writable Path — Post-Exploitation Persistence (locked: unlock with TL Creds)
- Unprivileged User+Network Namespace Creation (Precursor to Namespace-Reachable Kernel Bugs) (locked: unlock with TL Creds)
- Root Shell Spawned from User-Writable Path (Kernel LPE Outcome, CVE-2026-64563 et al.) — Post-Exploitation (locked: unlock with TL Creds)
- Kernel Fault Telemetry Naming Vulnerable Functions (CVE-2026-74544/64563/64580/98222) — Exploit Trigger Impact (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 11)

Defanged, TLP:CLEAR.

- File hash: `5d240a8936f6a1d3ece06701e8c4d830a2eca8a8`
- File hash: `8173f7e2ce67e6ca1d4763f3da14e5b01ce77456`
- File hash: `1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`

Full set of 11 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Microsoft Security Blog: Lessons from 59 Linux kernel bug reports](https://www.microsoft.com/en-us/security/blog/2026/11/11/lessons-from-59-linux-kernel-bug-reports/)
- [GBHackers: Microsoft AI Exposes 21-Year-Old Linux Kernel Bug Among 59 Security Issues Reported to Maintainers](https://gbhackers.com/linux-kernel-flaws/)
- [FORGE Lab: Linux kernel 3-month lookback](https://forge-blog.github.io/posts/linux-kernel-3-month-lookback/)
- [OSV: CVE-2026-64563 rhashtable: clear stale iter->p on table restart](https://osv.dev/vulnerability/CVE-2026-64563)
- [OSV: CVE-2026-74544 net/sched: cls_u32: validate offshift](https://osv.dev/vulnerability/CVE-2026-74544)
- [OSV: CVE-2026-64580 xfrm6_fill_dst double netdev_put](https://osv.dev/vulnerability/CVE-2026-64580)
- [OSV: CVE-2026-98222 KEYS: encrypted: fix integer overflow of datablob_len](https://osv.dev/vulnerability/CVE-2026-98222)
- [NVD: CVE-2026-74544](https://nvd.nist.gov/vuln/detail/CVE-2026-74544)
- [NVD: CVE-2026-64563](https://nvd.nist.gov/vuln/detail/CVE-2026-64563)
- [Red Hat Bugzilla 2517014 (CVE-2026-74544)](https://bugzilla.redhat.com/show_bug.cgi?id=2517014)
- [Red Hat Bugzilla 2510892 (CVE-2026-64563)](https://bugzilla.redhat.com/show_bug.cgi?id=2510892)
- [OpenCVE: CVE-2026-74544](https://app.opencve.io/cve/CVE-2026-74544)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5830