Microsoft's FORGE Lab conducted a project named MDASH to scan Linux kernel subsystems from late May to mid-June 2026. This initiative resulted in 59 public upstream reports and 33 assigned CVEs.
Among the CVEs identified, eight have confirmed working root privilege-escalation exploits. The project initially produced 26,502 raw findings over approximately two weeks, with the average age of the reported bugs being 8.1 years.
CVE-2026-64563, a one-line state-reset bug in rhashtable, was identified as enabling local privilege escalation on Linux. Of the 33 CVEs, 24 are rated High or above, with a CVSS v3.1 score of at least 7.0.
Fixes for 38 of the reports have been successfully merged into the upstream mainline. The first public report from this project was released on June 27, 2026, and the median time to reach a mainline release from the first public patch was 41 days.