Microsoft ships Azure Linux update with more than 470 vulnerability references

Microsoft has released Azure Linux 3.0.2022, an update that references more than 470 CVEs (publicly catalogued vulnerabilities). Some of those entries repeat because the same flaw affects several packages, so the number does not equal 470 separate security holes. It is still a very large amount of patching for a single release.

The fixes cover the Linux kernel, now at version 6.6.161.1, along with widely used components such as OpenSSL, curl, Kubernetes, Docker and QEMU. Container tools receive plenty of attention too, including KubeVirt, containerd and Docker Compose. The release also includes a certificate cleanup linked to the eMudhra incident, tracked as CVE-2026-114406. Microsoft has removed or distrusted root certificates that could validate compromised eMudhra intermediate certificates, and added checks in Python and Go to reject the affected certificates. It has kept SSL.com TLS trust in place where required.

The update also includes non-security changes, such as fixes for systemd hangs and adjustments to GRUB Secure Boot metadata. The Register notes the release arrives during an AI-fuelled surge in vulnerability discovery that is putting pressure on developers trying to keep up with patching.