vex csaf attestation

Microsoft’s short public statement — that “Azure Linux includes this open‑source library and is therefore potentially affected” — is accurate, actionable, and deliberately scoped: it confirms Microsoft’s inventory work for the Azure Linux product family, not a universal guarantee that no other...

Microsoft’s brief MSRC entry for CVE-2025-37792 — “Bluetooth: btrtl: Prevent potential NULL dereference” — is accurate for the product it names: Azure Linux has been identified as a carrier of the upstream Bluetooth code that required a fix. That attestation, however, is a product‑scoped...

The recently assigned CVE-2025-10148 — a predictable WebSocket mask bug in curl/libcurl — is real, it is patched upstream, and Microsoft’s short public attestation that “Azure Linux includes this open‑source library and is therefore potentially affected” is accurate for the product it covers...