Azure Linux 3.0.20261105-3.0 brings kernel and security updates

Microsoft published Azure Linux release 3.0.20261105-3.0 on November 7, 2026. The release lists security and package updates across four kernel tracks and changes to certificate handling. The Register reported more than 470 CVE references in the notes, with some references recurring across packages, so its tally does not establish a count of distinct vulnerabilities.

The reported CVE tally

The Register’s figure is a count of CVE references, not a confirmed total of unique vulnerabilities. Microsoft’s release notes list fixes across packages including OpenSSL, curl, Kubernetes-related components, Docker and Moby components, QEMU, containerd, and Python packages. The release page identifies the affected package entries and versions.

Four kernel tracks

Microsoft lists separate versions for the generic kernel and three other tracks in release 3.0.20261105-3.0:

Match a kernel version to its track: the generic, HWE, MSHV, and UVM entries are separate release versions.

Certificate trust and package updates

Microsoft’s release notes associate certificate changes with CVE-2026-114406. They describe removing or distrusting affected roots and adding checks in Python and Go to reject affected eMudhra intermediate certificates. The changes also retain SSL.com TLS trust where needed and refresh Microsoft trusted root certificates. Related package entries include ca-certificates, Go, gRPC, InfluxDB, NSS, Python tools, Ruby HTTP clients, and Telegraf.

The release also updates containerd2 to 2.3.7, nginx to 1.30.6, Python 3 to 3.12.16, and Go to 1.27.3-1. Microsoft lists PHP 8.3.36 and says PHP 8.3.35-2 or later includes fixes for PHP2Shell remote-code-execution vulnerabilities CVE-2026-109618 and CVE-2026-109619. The listed PHP version is above that threshold.

Other changes include an OpenVMM confidential-computing patch, a systemd event-loop hang fix, GRUB Secure Boot metadata changes, and removal of KEDA from Azure Linux.