Get the free digest
AI & Tech

Microsoft's Azure Linux gets 470-plus security fixes in one almighty patching session

Microsoft has unleashed a whopper of an update for Azure Linux, packing more than 470 CVE fixes into a single release as the software industry's ever-growing pile of vulnerabilities shows little sign of shrinking.

✦ Extractive summary — built from the sources' own reporting•From 1 source•1 min read•Updated November 9, 2026, 3:02 PM UTC
Key points
  • Azure Linux, formerly known as CBL-Mariner, is Microsoft's own Linux distribution, developed primarily for its cloud infrastructure and services.
  • The release includes less security-focused changes too, including new Dockerfiles, an OpenVMM patch for confidential computing support, fixes for systemd hangs, and adjustments to GRUB Secure Boot metadata.
  • Container infrastructure gets plenty of attention, too, with fixes spanning KubeVirt, containerd, Docker Compose, and other components used to keep cloud workloads running.

So that's not necessarily 470 separate security holes, but it's still an impressive amount of patching for one release.

Over the weekend, Microsoft rolled out Azure Linux 3.0.2022 with fixes covering everything from the Linux kernel to open source packages and container software.

Additional details
  • Microsoft's release notes contain more than 470 CVE references, although some vulnerabilities appear multiple times because they affect different packages.
  • The fixes span OpenSSL, curl, Kubernetes, Docker, QEMU, and a lengthy list of other packages that underpin modern Linux environments.
  • And judging by the size of this latest changelog, Microsoft's patching teams aren't likely to be putting their feet up anytime soon.
  • As The Register reported e arlier today, Linux creator Linus Torvalds reckons there may finally be signs that the flood is easing, at least in some corners of the kernel.
  • Torvalds said fixes are now arriving faster than new bug reports in the kernel's eBPF subsystem, although he noted that most other areas haven't reached that point.

How this summary was made: extractive summary — built from the sources' own reporting. It is drawn only from the reporting of the sources listed below — read the originals for full detail. How we summarize →

Advertisement

Every article behind this summary — 1 article from 1 outlet

The RegisterNovember 9, 2026, 3:02 PM UTC →

Related stories