Azure Linux 3.0.2022 (3.0.20261105-3.0): 470+ CVE references, kernel 6.6.161.1, eMudhra CA removal

Microsoft shipped Azure Linux 3.0.2022 (repository tag 3.0.20261105-3.0) with a changelog that cites more than 470 CVE references, a new generic kernel, and a certificate clean-up that removes or distrusts roots tied to the eMudhra incident, CVE-2026-114406. If you run Azure Linux on VMs, AKS nodes or as a container base image, here is what changed and how to check that your systems actually have it.

Key points

• Azure Linux 3.0.2022 (tag 3.0.20261105-3.0) is marked "Latest" on the project's GitHub releases page; The Register says it was rolled out over the weekend of 7 to 8 November 2026.
• The changelog contains more than 470 CVE references, but many repeat across packages, so it is not 470 separate vulnerabilities (The Register and WindowsForum both say so).
• The generic kernel is now 6.6.161.1-1; the release notes say the fix for the "PwnEscape" issue (CVE-2026-99999) arrived in kernel 6.6.159.1-1 or later.
• Certificate trust changes respond to the eMudhra incident (CVE-2026-114406): affected roots are removed or distrusted, and Python and Go now reject the compromised intermediates; SSL.com TLS trust is kept where needed.
• Updating a node does not update packages inside its containers; check those separately.

What to do

• Who is affected: anyone running Azure Linux 3.0, including AKS node pools that use it and container images built on it.
• Fix: move to the 3.0.2022 package set. On VMs, either deploy a newer image through a controlled rollout or update packages in place. On AKS, node OS upgrades update the node image without changing the Kubernetes version; compare the pool's nodeImageVersion with latestNodeImageVersion and confirm after upgrading. Regional rollout of node images can take up to two weeks, per WindowsForum's analysis. The GitHub release page itself has no update instructions; Microsoft's "Update an Azure Linux Virtual Machine" and "Manage CVEs on Azure Linux" documents cover them.
• How to check: compare package revisions through RPM metadata or the image's SBOM, not just version strings. Azure Linux backports security fixes (for example to OpenSSL) without changing the upstream version number, so openssl version alone can mislead.
• Practical check on a VM: uname -r should report a 6.6.161.1 kernel after the update and reboot, and rpm -q --changelog <package> | grep CVE-<id> shows whether a given package's changelog mentions the fix. A kernel update only takes effect after a reboot.
• Containers: rebuild and redeploy container images separately from the node.

What happened

The GitHub release page lists kernel 6.6.161.1-1 as the generic kernel and a long list of package updates. The Register counted more than 470 CVE references in the notes, spanning OpenSSL, curl, Kubernetes, Docker, QEMU and other packages, and said the changelog "runs to hundreds of entries". We could not verify a distinct-CVE total ourselves: the release page is long and the count of unique identifiers is not stated, so we do not give one. Microsoft has not said whether AI-assisted research found any of the flaws, according to The Register.

Selected packages named on the release page include Golang 1.27.3-1, Python 3.12.16, Ruby 3.3.13, Rust 1.98.1, nginx 1.30.6, PHP 8.3.36, Node.js 24.22.1, containerd2 2.3.7, moby-engine 25.0.18, etcd 3.5.35, httpd 2.4.69, bind 9.20.30, Valkey 8.0.12, Vim 9.2.1244 and tzdata 2026f. Other kernels in the release are kernel-hwe 6.18.57.1, kernel-mshv 6.18.58.mshv2 and kernel-uvm 6.18.52.mshv1. RabbitMQ Server received patches for 16 CVEs, and the notes also mention two PHP2Shell identifiers, CVE-2026-109618 and CVE-2026-109619.

Background

Azure Linux, formerly CBL-Mariner, is Microsoft's own Linux distribution, built mainly for its cloud infrastructure and services, which is why a large release matters beyond people who chose it deliberately. The size of this release arrives in a month when other projects also describe a flood of AI-assisted bug reports: the OpenSSH project said in its 10.6p2 release notes that it has received a large number of security reports, many from AI models or AI-assisted, and will release more often as a result. Linus Torvalds, per The Register, sees signs that the flow is easing in the kernel's eBPF subsystem, though not elsewhere.

The eMudhra certificate change

Amazon's advisory for CVE-2026-114406, public 21 October 2026 and last modified 6 November, explains the issue: root CA certificates belonging to authorities that signed eMudhra intermediate CA certificates with weak private keys were removed under a primary fix, CVE-2026-113470, so systems with that update no longer trust the weak intermediates. CVE-2026-114406 goes further and removes the remaining CA certificates tied to the same operators: emSign Root CA G1, emSign Root CA G2 (code signing), emSign Root CA C2 (code signing), and the AAA Certificate Services root, which Amazon says was already distrusted for TLS since 2025. Amazon rates it Medium, CVSS 3.1 score 6.8, and gives customers who still need emSign Root CA G1 a way to re-enable it.

Azure Linux's release notes list twelve packages touched by the certificate response: ca-certificates, golang, grpc, influxdb, mstflint, nss, python-pip, python-virtualenv, python3, rubygem-excon, rubygem-httpclient and telegraf. Microsoft removed or distrusted the affected roots and added checks in Python and Go to reject the compromised intermediates, while preserving SSL.com TLS trust where required (The Register). Microsoft's trusted root certificates were also refreshed in ca-certificates.

What it means

The headline number invites two wrong conclusions. One is that Azure Linux suddenly had 470 new holes; the other is that one release closes them all everywhere. Neither holds. Repeated identifiers show that the same upstream flaw is fixed in several packages, and each deployment layer (VM image, AKS node image, container image) has its own patch path and its own timing.

For operators the practical risk is not the raw count but the gap between "released" and "running". A distribution announcement does not prove that your image, node or container contains the fix. The certificate change can also break things: a service that relied on an emSign-issued certificate may start failing TLS validation after the update, so test internal and partner connections that use certificates from that operator before a wide rollout. Scanner findings after the update are not automatically false positives, since backported fixes keep old version strings; match on package revision and vendor advisory.

What we don't know yet

Microsoft's release page does not describe update steps, and we could not confirm the exact release date: GitHub shows 7 November without a year, the tag carries 5 November, and The Register says "over the weekend". We also have no figure for how many of the CVEs are actively exploited, or which are most urgent; the page lists identifiers without exploitability data. The severity of CVE-2026-114406 for Azure Linux specifically is not stated by Microsoft in what we read.

What to watch next

Watch Microsoft's AKS node image release notes for the version that carries 3.0.2022, any follow-up point release for regressions from the certificate change, and the primary CVE-2026-113470 fix as it reaches other distributions.

Sources

• Azure Linux release 3.0.2022 (tag 3.0.20261105-3.0), GitHub (primary)
• The Register: Microsoft's Azure Linux gets 470-plus security fixes in one almighty patching session
• WindowsForum: Azure Linux 3.0 security update, 470 CVE references and what admins need to verify
• Amazon Linux Security Center: CVE-2026-114406
• OpenSSH release notes, 10.6p2