Science & Tech · Cybersecurity · 2 hrs ago
Microsoft releases Azure Linux update with more than 470 CVE references
Microsoft released Azure Linux 3.0.2022 with a large set of security fixes.
The release notes list more than 470 CVE references, though some vulnerabilities are listed more than once, so that does not mean 470 separate security holes.
The fixes cover components including OpenSSL, curl, Kubernetes, Docker and the Linux kernel, which was updated to version 6.6.161.1.
Microsoft also changed certificate trust settings after an incident involving eMudhra certificates, adding checks in Python and Go to reject affected certificates.
Azure Linux, formerly called CBL-Mariner, is Microsoft's Linux distribution, used mainly for its cloud infrastructure and services.
Keeping its components patched matters because they help run cloud workloads, while developers face a growing volume of vulnerabilities.
The release gives no timetable for further updates, and Microsoft has not said whether AI-assisted research contributed to the vulnerabilities addressed.
Microsoft released Azure Linux 3.0.2022 with more than 470 CVE references in its release notes.
The update includes fixes for the Linux kernel, OpenSSL, curl, Kubernetes, Docker, QEMU and other components.
Some vulnerabilities appear multiple times because they affect different packages, so the references do not necessarily represent 470 separate security holes.
The release also addresses risks linked to compromised eMudhra intermediate certificates.
Azure Linux is Microsoft’s Linux distribution, developed primarily for its cloud infrastructure and services.
- Who
- Microsoft released the update.
- What
- Azure Linux 3.0.2022 includes more than 470 CVE references and fixes across the operating system and its packages.
- When
- Over the weekend before the article was published on 2026-11-09.
- Where
- Azure Linux, Microsoft’s Linux distribution for its cloud infrastructure and services.
- Why
- To address vulnerabilities in the kernel, open-source packages and container software, among other changes.
This story does not have two clearly opposing sides.
This story does not have a timeline yet.
- Release
- Azure Linux 3.0.2022
- CVE references
- More than 470
- Kernel version
- 6.6.161.1
- Certificate incident
- eMudhra, tracked as CVE-2026-114406
- Former name
- CBL-Mariner