Azure Linux 3.0 update distrusts eMudhra roots and patches 274 CVE numbers

Azure Linux 3.0 update distrusts eMudhra roots and patches 274 CVE numbers

7 November 2026: Microsoft has shipped a new Azure Linux 3.0 release that removes trust in the certificates caught up in the eMudhra incident. Release 3.0.20261105-3.0 is also a very large security roll-up, so anyone running the distribution on hosts or containers should plan to take it soon.

Not yet independently verified. The count of 274 is our own tally of distinct CVE numbers in Microsoft's release notes, not a figure Microsoft states. We have not tested the packages, and the notes do not say whether any listed flaw has been exploited. We will update this when it can be confirmed, and remove this note.

The certificate changes

The release notes describe the work as hardening certificate trust after CVE-2026-114406. Microsoft removed or distrusted root certificates that could validate the compromised eMudhra intermediates, added intermediate-certificate rejection in Python and Go, and kept SSL.com TLS trust where it was still needed. It also refreshed the Microsoft trusted root certificates.

Twelve packages carry the change:

Package	Version-release	Change
ca-certificates	1:3.0.0-19	Refreshes Microsoft trusted roots
golang	1.27.3-1	Rejects the intermediates in crypto/x509 (CVE-2026-111943)
python3	3.12.16-1	Rejects the intermediates, removes roots from the ensurepip wheel
nss	3.96.1-4	Explicitly distrusts affected roots
grpc	1.62.3-4	Removes roots, preserves SSL.com TLS trust
influxdb	2.7.5-23	Removes roots from the Snowflake bundle, preserves SSL.com
telegraf	1.31.0-36	Removes roots from the Snowflake bundle
mstflint	4.28.0-3	Removes roots, preserves SSL.com
python-pip	24.2-11	Removes roots from bundled certifi
python-virtualenv	20.36.1-10	Removes roots from embedded pip wheels
rubygem-excon	0.102.0-4	Removes roots, preserves SSL.com
rubygem-httpclient	2.8.3-3	Removes the cross-signing root, preserves SSL.com

Why the list reaches so far

Several of those packages bring their own certificate bundles, which is why patching the system store alone would not have been enough. Telegraf and InfluxDB carry a Snowflake bundle, pip carries certifi, and virtualenv embeds pip wheels. A company auditing its own images should look for the same pattern in anything it builds on top, because a vendored bundle will not follow the operating system's update.

The rest of the roll-up

The generic kernel moves to 6.6.161.1-1. Counting the release notes ourselves, they name 274 distinct CVE numbers across a long list of patched and upgraded packages. Those include cert-manager, azcopy, the Application Gateway Kubernetes ingress controller, busybox and binutils. Unbound goes to 1.26.2, wpa_supplicant to 2.12, zchunk to 1.5.5, and valkey to 8.0.12.

There are also functional fixes worth reading before rollout. GRUB's Secure Boot metadata now raises SBAT to grub,6, and the kernel package can now be installed alongside kernel-hwe. A containerd2 fix addresses wrapped ENOTSUP during relabel, and systemd gets a backported sd-event fix for a hang after ratelimit expiry.

How this fits the eMudhra story

This is the operating system side of a clean-up already running across the industry. eMudhra has left the global SSL and TLS certificate business after the key compromise. Python's own releases, Oracle Java and JetBrains' tools have all moved already.

Azure is in our catalogue, and our security advisories section tracks the other vendors still working through this.

Sources

• Microsoft Azure Linux on GitHub: release 3.0.20261105-3.0, published 7 November 2026, 04:08 UTC, 7 November 2026