security advisory

CVE-2025-38107 fixes a race in the Linux kernel’s ETS qdisc, and Microsoft’s public advisory names Azure Linux as a product that “includes this open‑source library and is therefore potentially affected” — but that wording is an inventory attestation for Azure Linux, not proof that no other...

A deceptively small bug in the Linux kernel’s virtual Wi‑Fi driver — tracked as CVE‑2024‑43841 — has prompted an important question from customers: when Microsoft’s update guide states that “Azure Linux includes this open‑source library and is therefore potentially affected,” does that mean...

CVE-2025-22058 is a Linux kernel bug that causes a UDP memory-accounting leak — and while Microsoft’s public guidance has explicitly named Azure Linux as a product that “includes this open‑source library and is therefore potentially affected,” that statement is a product‑scoped attestation, not...

Curve.IsOnCurve in Go’s crypto/elliptic produced a rare but serious correctness failure that could be weaponized to crash or misbehave cryptographic code; the bug was fixed in the Go project’s February 2022 point releases (Go 1.16.14 and Go 1.17.7), and maintainers and downstream vendors issued...

The Linux kernel CVE‑2024‑45025 — a subtle bitmap‑copy bug that can leave stale bits set after a call to close_range() when used with the CLOSERANGE_UNSHARE flag — has been fixed upstream, and Microsoft’s public guidance currently identifies Azure Linux as the Microsoft product family they have...

A critical local privilege‑escalation bug in Ceph’s crash‑handling service — tracked as CVE‑2022‑3650 — lets an attacker with low privileges escalate to root by abusing the cluster crash‑dump path, and operators must treat it as a high‑impact, operational risk until patched. Multiple downstream...

A subtle bug in a widely used Go PostgreSQL driver has opened the door to SQL injection under a narrow—but realistic—set of conditions, and the fix requires immediate attention from any team that embeds the pgx library. The vulnerability, tracked as CVE-2024-27289, allows user-controlled input...

The path‑traversal vulnerability tracked as CVE‑2024‑29180 in the open‑source package webpack‑dev‑middleware is a developer‑focused high‑severity flaw that can allow attackers to read arbitrary files from a developer’s machine when a vulnerable development server is reachable; Microsoft’s terse...

A small assertion bug in the open‑source libnbd client library (tracked as CVE‑2021‑20286) can cause a denial‑of‑service; Microsoft’s public advisory names Azure Linux as a product that “includes this open‑source library and is therefore potentially affected,” but that statement is a scoped...

Microsoft’s short advisory that “Azure Linux includes this open‑source library and is therefore potentially affected” is accurate — but it is a scoped, product‑level attestation, not a technical guarantee that no other Microsoft product can contain the same vulnerable GNU Binutils code...

The Linux kernel has received a targeted fix for a subtle but real correctness bug in the virtio sound driver that could trigger kernel workqueue warnings and disrupt system availability in virtualized environments: CVE-2025-37805 addresses uninitialized work_structs in the virtio_snd driver so...

A pair of kernel maintainers closed a subtle but operationally important deadlock in the Linux kernel’s BPF/tracing stack: a locking inversion between the RCU trace path and the global tracing event mutex could hang a host under realistic local workloads, and the upstream remedy delegates...

A subtle bug in QEMU’s built‑in VNC server — tracked as CVE‑2023‑3354 — can be triggered by a remote, unauthenticated client and force a denial‑of‑service through a NULL pointer dereference during the TLS handshake, making this a high‑impact availability flaw that virtualization administrators...

Microsoft’s short answer — no, Azure Linux is not necessarily the only Microsoft product that could include the vulnerable open‑source code — but it is the only Microsoft product Microsoft has publicly attested, at the time of its advisory, to include the specific upstream component implicated...

A subtle but important flaw in the Linux kernel's s390 SCLP handler — tracked as CVE-2025-39694 — has been fixed upstream, and Microsoft’s security guidance currently identifies Azure Linux as the only Microsoft product known to include the affected kernel component; however, the...

Microsoft’s handling of confidential computing has taken another high‑stakes turn with CVE‑2026‑23655, an information disclosure vulnerability that targets Azure’s Confidential Container capabilities and raises urgent questions about the real‑world assurances provided by hardware‑backed TEEs...

Rockwell Automation’s ArmorStart LT has been publicly flagged for multiple denial-of-service (DoS) vulnerabilities that can render affected motor controllers unresponsive, forcing manual recovery and potentially interrupting production lines. Rockwell’s SD1768 advisory lists nine CVE identifiers...

The Windows Management Services (WMSvc) elevation‑of‑privilege tracked as CVE‑2026‑20861 is one of a cluster of Windows management‑component vulnerabilities disclosed with Microsoft’s January 2026 security updates. For organizations running server and desktop Windows builds where the Windows...

The Linux kernel has been assigned CVE-2025-68753 for a vulnerability in the ALSA firewire-motu driver where a flawed copy loop using put_user could write beyond a user buffer when the buffer size is not aligned to 4 bytes; upstream developers patched the driver by adding a bounds check and...

The Linux kernel vulnerability tracked as CVE-2025-38480 has been published: a subtle correctness bug in the COMEDI subsystem where the helper function insn_rw_emulate_bits could read uninitialized data when presented with an instruction that specifies zero samples. Upstream kernel maintainers...