Microsoft’s FORGE Lab turned 26,502 automated Linux kernel findings into 59 upstream reports, with fixes for 38 reports merged into mainline. Its November 11 retrospective shows why scan totals are a poor measure of security progress.
After screening, 11,769 candidates remained. Reproduction agents produced 621 cases with proof-of-concept evidence; experts then reviewed root causes, duplicates and impact. Many cases shared a cause or had already been reported or fixed.
The lab’s published list contains 33 assigned CVEs. Researchers confirmed local root privilege escalation for eight in controlled environments, sometimes with non-default settings or disabled mitigations. Those laboratory results do not establish exploitation in the wild.
The workload matters as much as the discovery rate: reporting 59 issues took more than four person-months. Scanning had taken roughly two weeks.
For security teams, the useful lesson is to budget for reproduction, maintainer review and patch delivery alongside discovery. Track validated issues and deployed fixes separately: a mainline merge still needs a route into the kernels your systems run.
Chart: Microsoft FORGE Lab, scan-to-report workflow.
