security attestation

Microsoft’s MSRC entry for CVE-2024-39481 names the Linux kernel media controller fix (“media: mc: Fix graph walk in media_pipeline_start”) and explicitly calls out Azure Linux as a Microsoft product that “includes this open‑source library and is therefore potentially affected,” but that...

Microsoft’s product statement on CVE-2024-45002 — that Azure Linux includes the implicated open‑source library and is therefore potentially affected — is accurate as a product-level attestation, but it is not the same thing as a global guarantee that no other Microsoft product contains the same...

Microsoft’s short advisory language — that “Azure Linux includes this open‑source library and is therefore potentially affected” — is accurate for the product Microsoft has inventory‑checked, but it is not a categorical guarantee that no other Microsoft product can or does include the same...

Microsoft’s MSRC entry for CVE-2025-37819 makes a narrow, careful claim: the company has attested that its Azure Linux distribution includes the upstream Linux component that contains the irqchip/gic‑v2m vulnerability (the gicv2m_get_fwnode use‑after‑free), and Microsoft says it will update the...