Microsoft’s public mapping for CVE‑2025‑37780 names the Azure Linux distribution as a confirmed carrier of the vulnerable code, but that attestation is a product‑scoped inventory statement — not a mathematical guarantee that no other Microsoft product or image can contain the same vulnerable...