Friday, November 13, 2026 News from Linux distributions' own feeds Linux stable 7.3.4 · longterm 6.18.63
DistroNews

The week in Linux, gathered from the distributions' own feeds

Paper
Azure Linux Releases

Azure Linux 3.0.20261105

github.com

Key points

Azure Linux 3.0.20261105 was published on 7 November. It moves the generic kernel to 6.6.161.1-1, tightens certificate trust after the eMudhra incident (CVE-2026-114406) and carries a large batch of CVE patches and package upgrades. KEDA is no longer part of the distribution.

Kernels

  • kernel goes to 6.6.161.1; the PwnEscape flaw (CVE-2026-99999) was already fixed from 6.6.159.1-1 onward.
  • kernel-hwe is now 6.18.57.1, kernel-mshv 6.18.58.mshv2 and kernel-uvm 6.18.52.mshv1.
  • kernel can now be installed alongside kernel-hwe.
  • The kernel now exposes read-only Btrfs backing to IPE.

Certificate trust

  • Root certificates able to validate compromised eMudhra intermediates were removed or distrusted, while SSL.com TLS trust is kept where needed.
  • ca-certificates 1:3.0.0-19 refreshes the Microsoft trusted roots.
  • nss 3.96.1-4 explicitly distrusts the affected roots.
  • golang 1.27.3-1 rejects the compromised intermediates in crypto/x509 (CVE-2026-111943).
  • python3 3.12.16-1 rejects the eMudhra intermediates and drops the affected roots from its ensurepip wheel.
  • Bundled trust stores were cleaned in grpc 1.62.3-4, influxdb 2.7.5-23, mstflint 4.28.0-3, python-pip 24.2-11, python-virtualenv 20.36.1-10, rubygem-excon 0.102.0-4, rubygem-httpclient 2.8.3-3 and telegraf 1.31.0-36.

Security upgrades

  • Servers and network: bind 9.20.30, httpd 2.4.69, nginx 1.30.6, unbound 1.26.2, pgbouncer 1.26.1, valkey 8.0.12, frr 10.5.5 (follow-up complete fix for CVE-2016-4049), wpa_supplicant 2.12, cifs-utils 7.9, dpdk 23.11.8.
  • Languages and libraries: python3 3.12.16, php 8.3.36, ruby 3.3.13, nodejs 24.22.1, expat 2.9.0, c-ares 1.34.8, brotli 1.2.1-1 (Broccoli2Shell, CVE-2026-111497), thrift 0.25.0, python-jwt 2.15.1, python-msgpack 1.2.3, perl-DBI 1.655, objectweb-asm 9.11.1, libslirp 4.9.6, zchunk 1.5.5, afflib 3.7.23.
  • X11: libX11 1.8.14, libXrender 0.9.13, libXi 1.8.4, libXpm 3.5.20, libXtst 1.2.6, xorg-x11-server-Xwayland 24.1.14.
  • Containers and tools: containerd2 2.3.7, etcd 3.5.35, gh 2.102.0, azurelinux-image-tools v1.7.0, environment-modules 5.3.2.
  • The PHP2Shell remote-code-execution fixes (CVE-2026-109618, CVE-2026-109619) are present in PHP 8.3.35-2 or later.

Other upgrades

  • golang 1.27.3-1, rust 1.98.1, kata-containers 4.1.0.kata1, moby-engine 25.0.18, openvmm 0.4.0, trident 0.30.0, tzdata 2026f, vim 9.2.1244.

CVE patches

  • Base system and libraries: openssl (12 CVEs), curl, krb5, sudo, tar, zlib, util-linux, busybox, binutils, perl, popt, rsync, sos, alsa-lib, aspell, freetype, glib-networking, libical, libnfs, librsvg2, libsndfile, libsoup, hdf5, opensc, qtbase, qtdeclarative.
  • Services and applications: avahi, bluez, cups, haproxy, squid, libreswan, nfs-utils, nmap, ntopng, iperf3, fluent-bit, rabbitmq-server (16 CVEs), erlang, emacs, gnuplot, conda, guava, javapackages-bootstrap, python-oauthlib, python-twisted, python-urllib3, python-virtualenv.
  • Virtualisation: qemu, libvirt, edk2, kubevirt, kata-containers, kata-containers-cc, containerized-data-importer, cloud-provider-kubevirt.
  • Containers and Kubernetes: kubernetes, runc, moby-engine, moby-containerd-cc, docker-cli, docker-buildx, docker-compose, cri-tools, skopeo, coredns, flannel, multus, kured, cert-manager, kube-vip-cloud-provider, application-gateway-kubernetes-ingress, sriov-network-device-plugin, opa.
  • Monitoring and other tools: telegraf (21 CVEs), influxdb, prometheus-adapter, prometheus-node-exporter, prometheus-process-exporter, vitess, packer, azcopy, cf-cli, git-lfs, jx, ignition-flatcar.

Fixes and additions

  • grub2 Secure Boot metadata is corrected by raising SBAT to grub,6.
  • systemd gets a backported sd-event fix for a hang after ratelimit expiry.
  • containerd2 now handles a wrapped ENOTSUP error during relabel.
  • A kubevirt-openvmm SPEC and GoldenCtr Dockerfiles were added, and openvmm gains a patch for confidential support.
  • Golden container tags now use build dates independently of base container versions.
  • dnf5 builds again with expat 2.9.0, and a ukify test fix was backported for newer OpenSSL.
  • ptest failures in eight Python packages were fixed by pinning packaging to 23.2.
  • python-virtualenv received fixes to its security backports, development test reconciliation and test bootstrap, keeping RPM-owned packaging.

Summary by DistroNews, based on the original post.

The full text is on the original page.

Read the original at github.com