Microsoft's Azure Linux gets 470-plus security fixes in one almighty patching session

A mountain of CVEs, a certificate cleanup, and yet more work for Microsoft's patching teams

Microsoft has unleashed a whopper of an update for Azure Linux, packing more than 470 CVE fixes into a single release as the software industry's ever-growing pile of vulnerabilities shows little sign of shrinking.

Over the weekend, Microsoft rolled out Azure Linux 3.0.2022 with fixes covering everything from the Linux kernel to open source packages and container software. The changelog runs to hundreds of entries, so anyone planning to read the whole thing might want to put the kettle on.

Microsoft's release notes contain more than 470 CVE references, although some vulnerabilities appear multiple times because they affect different packages. So that's not necessarily 470 separate security holes, but it's still an impressive amount of patching for one release.

REG AD

The fixes span OpenSSL, curl, Kubernetes, Docker, QEMU, and a lengthy list of other packages that underpin modern Linux environments. The generic Linux kernel has been updated to version 6.6.161.1.

REG AD

There's also been some housekeeping following the eMudhra certificate incident, tracked as CVE-2026-114406. Microsoft has removed or distrusted root certificates that could validate compromised eMudhra intermediate certificates, while adding checks in Python and Go to reject the affected certificates. It has also preserved SSL.com TLS trust where required, presumably to avoid fixing one certificate headache by creating another.

Container infrastructure gets plenty of attention, too, with fixes spanning KubeVirt, containerd, Docker Compose, and other components used to keep cloud workloads running. Several CVEs crop up repeatedly across these packages, helping explain the eye-watering number of entries in the changelog.

The release includes less security-focused changes too, including new Dockerfiles, an OpenVMM patch for confidential computing support, fixes for systemd hangs, and adjustments to GRUB Secure Boot metadata.

The hefty release comes amid an AI-fueled surge in vulnerability discovery that has left developers struggling to keep up with the resulting patch workload. As The Register reported earlier today, Linux creator Linus Torvalds reckons there may finally be signs that the flood is easing, at least in some corners of the kernel.

Torvalds said fixes are now arriving faster than new bug reports in the kernel's eBPF subsystem, although he noted that most other areas haven't reached that point. Whether the wider software industry is anywhere close to catching up is another matter, and Microsoft hasn't said if AI-assisted research contributed to the vulnerabilities addressed in this release.

Azure Linux, formerly known as CBL-Mariner, is Microsoft's own Linux distribution, developed primarily for its cloud infrastructure and services. That makes keeping its many components patched rather more important than the modest version-number bump might suggest.

And judging by the size of this latest changelog, Microsoft's patching teams aren't likely to be putting their feet up anytime soon. ®