Microsoft's Azure Linux 3.0.2022 release fixes more than 470 CVE references, including the eMudhra certificate incident
Microsoft released Azure Linux 3.0.2022, its in-house distribution built mainly for cloud infrastructure, and the release notes carry more than 470 CVE references (phoronix.com). Many entries repeat because the same flaw touches several packages, so the count does not equal 470 distinct vulnerabilities. The fixes span the Linux kernel (updated to 6.6.161.1), OpenSSL, curl, Kubernetes, Docker, QEMU and container components such as containerd, KubeVirt and Docker Compose. The release also responds to the eMudhra certificate incident, tracked as CVE-2026-114406, by removing or distrusting roots that could validate compromised intermediates and by adding rejection checks in Python and Go. No exploitation is reported, and Microsoft has not said whether AI-assisted research produced the findings, so the criticity is medium.
Entenda a falha
A vulnerabilidade
CVE-2026-114406 is the eMudhra certificate incident: root certificates in the trust store could validate compromised eMudhra intermediate certificates. The articles do not describe what an attacker needs or gets beyond that. Azure Linux 3.0.2022 removes or distrusts the affected roots and adds checks in Python and Go that reject the affected certificates. It also keeps SSL.com TLS trust where required. The same release carries more than 470 CVE references across the kernel (updated to 6.6.161.1), OpenSSL, curl, Kubernetes, Docker, QEMU, containerd, KubeVirt and Docker Compose. Many entries repeat, so the count is not 470 distinct flaws. Per-package affected and fixed versions are not given.
Como funciona
The articles do not detail the technical flow. In general terms, a system validating a TLS certificate chain trusts a certificate if it chains to a root in its trust store. If that root can vouch for compromised eMudhra intermediates, certificates issued through them would be accepted. Microsoft's response is to remove or distrust those roots and to add rejection checks in Python and Go.
Por que é vulnerável
The articles name no root cause beyond the compromise of eMudhra intermediate certificates and the fact that existing roots could still validate them. The fix works on trust: it distrusts or removes the affected roots and makes Python and Go reject the affected certificates. For the other 470-plus CVE references, the articles give no individual causes.
Como foi descoberta
The articles do not say how the eMudhra incident or the other flaws were found. The Register reports the Azure Linux 3.0.2022 release over the weekend before 9 November 2026, with the changes listed in Microsoft's release notes. It notes that Microsoft has not said whether AI-assisted research contributed to the vulnerabilities fixed. No exploitation is reported.
Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 14:19.
Detalhes técnicos
- The release notes list more than 470 CVE references across the kernel, open-source packages and container software (phoronix.com).
- Certificate handling: affected eMudhra roots were removed or distrusted, Python and Go gained checks against the compromised intermediates, and SSL.com TLS trust was kept where required.
- Non-security changes include new Dockerfiles, an OpenVMM patch for confidential computing support, systemd hang fixes and GRUB Secure Boot metadata adjustments (phoronix.com).
Remediação
- Azure Linux operators should move to 3.0.2022, which carries the listed fixes.
- The article gives no per-package fixed versions. The Microsoft release notes were not opened during this research, so the affected and fixed versions of individual components could not be confirmed.
Linha do tempo
-
Microsoft's Azure Linux 3.0.2022 release fixes more than 470 CVE references, including the eMudhra certificate incident
ler a análise desta fonte ocultar
Microsoft released Azure Linux 3.0.2022, its in-house distribution built mainly for cloud infrastructure, and the release notes carry more than 470 CVE references (phoronix.com). Many entries repeat because the same flaw touches several packages, so the count does not equal 470 distinct vulnerabilities. The fixes span the Linux kernel (updated to 6.6.161.1), OpenSSL, curl, Kubernetes, Docker, QEMU and container components such as containerd, KubeVirt and Docker Compose. The release also responds to the eMudhra certificate incident, tracked as CVE-2026-114406, by removing or distrusting roots that could validate compromised intermediates and by adding rejection checks in Python and Go. No exploitation is reported, and Microsoft has not said whether AI-assisted research produced the findings, so the criticity is medium.
Technical Details
- The release notes list more than 470 CVE references across the kernel, open-source packages and container software (phoronix.com).
- Certificate handling: affected eMudhra roots were removed or distrusted, Python and Go gained checks against the compromised intermediates, and SSL.com TLS trust was kept where required.
- Non-security changes include new Dockerfiles, an OpenVMM patch for confidential computing support, systemd hang fixes and GRUB Secure Boot metadata adjustments (phoronix.com).
Remediation
- Azure Linux operators should move to 3.0.2022, which carries the listed fixes.
- The article gives no per-package fixed versions. The Microsoft release notes were not opened during this research, so the affected and fixed versions of individual components could not be confirmed.