Azure Linux 3.0.2022 bundles more than 470 CVE fixes
Original title: Microsoft's Azure Linux gets 470-plus security fixes in one almighty patching session
The kernel moves to 6.6.161.1, and Microsoft distrusts certificates tied to the eMudhra incident.
Microsoft released Azure Linux 3.0.2022 over the weekend with fixes spanning the Linux kernel, OpenSSL, curl, Kubernetes, Docker, QEMU and container software. Release notes cite more than 470 CVE references, some repeated because they affect multiple packages. The update also distrusts roots that could validate compromised eMudhra intermediate certificates, tracked as CVE-2026-114406, and adds Python and Go checks while preserving SSL.com TLS trust where required.
Unconfirmed: Microsoft has not said whether AI-assisted research found the flaws, and some CVE references are repeated across packages.
- Azure Linux was formerly known as CBL-Mariner.
- The generic Linux kernel is updated to 6.6.161.1.
- Container fixes cover KubeVirt, containerd and Docker Compose.
- SSL.com TLS trust was preserved where required.
- The release also includes an OpenVMM confidential-computing patch.
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Azure Linux | — | 3.0.2022 |
| Linux kernel | — | 6.6.161.1 |
- 1.Deploy Azure Linux 3.0.2022 to pick up the bundled CVE fixes.
- CVEs
- CVE-2026-114406
- Vendors
- Microsoft
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114406 | Trusted weak eMudhra intermediates in Red Hat system CA store | 6.8 | — |
From the original article
2 min read at theregister.comA mountain of CVEs, a certificate cleanup, and yet more work for Microsoft's patching teams
By Carly Page · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.