Microsoft has shipped a major security update for Azure Linux, its own Linux distribution for cloud workloads, packing more than 470 CVE references into a single release. The update, Azure Linux 3.0.2022, was released over the weekend and reported on 9 and 10 November 2026.

The fixes span the software that sits underneath much of Microsoft's cloud platform: the Linux kernel, OpenSSL, curl, Kubernetes, Docker, QEMU and a long list of other packages. The generic Linux kernel moves to version 6.6.161.1, and container infrastructure gets particular attention, with updates for KubeVirt, containerd and Docker Compose.

470 references is not 470 separate flaws

The headline number needs a careful reading. Microsoft's release notes contain more than 470 CVE references, but some vulnerabilities appear more than once because they affect different packages. The count measures the breadth of the servicing work, not a deduplicated list of distinct flaws.

That distinction matters for teams triaging scanner output. A single CVE can be listed against several packages, and each reported finding still needs to be checked against the package version actually installed. The release is a large routine servicing update, not an emergency response to a single exploited bug, and Microsoft has not linked it to any active attack.

Certificate clean-up after the eMudhra incident

The release also includes housekeeping following the eMudhra certificate incident, tracked as CVE-2026-114406. Microsoft has removed or distrusted root certificates that could validate compromised eMudhra intermediate certificates, and has added safeguards in Python and Go environments to block the use of compromised certificates.

Certificate trust stores are easy to overlook in a patch cycle, but a compromised intermediate certificate can be used to make a fake service look legitimate. Removing the affected roots from the distribution closes that route for systems running Azure Linux.

More than patches in this release

Beyond the security fixes, the release brings several platform improvements. It adds new Dockerfiles, an OpenVMM patch to support confidential computing scenarios, fixes for systemd-related hangs and updates to GRUB Secure Boot metadata.

Azure Linux, formerly known as CBL-Mariner, is the distribution Microsoft builds and maintains for its own cloud infrastructure. It underpins Azure services and the Azure Linux Container Host used by Azure Kubernetes Service, so the update reaches a large share of the company's cloud estate.

What administrators should do

Teams running Azure Linux should move to the 3.0.2022 release, tagged 3.0.20261105-3.0, and confirm that downstream images and node pools have actually picked it up. Updating a host does not update the packages inside the containers running on it, so container images need their own rebuild and redeployment.

The size of the release also underlines a wider trend: the volume of vulnerability reports keeps growing, and a single operating system update can now carry hundreds of fixes. For cloud teams, that makes testing and staged rollouts as important as the patch itself, so a large update does not break production while it is closing holes.