The researchers identified an exploitable path through Netlink socket diagnostics, which are accessible to unprivileged users. By manipulating memory, an attacker could turn the flaw into a constrained kernel memory-write primitive that, combined with other exploitation techniques, could enable local privilege escalation, Microsoft explained.
The company said this vulnerability was exploitable on standard Linux configurations without requiring special kernel configurations or user namespaces. It also affected Android devices with SELinux enforcing.
Across the 59 reports, the average age of a bug was 8.1 years when Microsoft first reported it publicly. One vulnerability, CVE-2026-74544, had been present in the kernel for at least 21 years, the researchers said.
