A cluster can be current on Kubernetes and still run an older node image. Microsoft’s AKS bulletin gives you a specific Azure Linux image to check for two kernel vulnerabilities.
What changed. Microsoft published AKS-2026-0007 on November 2, 2026. The bulletin supplies AKS-specific affected image ranges and a fixed Azure Linux kernel for CVE-2026-98432 and CVE-2026-99999. First verified in this watch on November 9, 2026 UTC.
Which node pools to check
Azure Linux. AKS images earlier than 202610.23.0 are affected. Microsoft identifies 202610.23.0 with kernel 6.6.159.1-1 as fixed and available in its listed regions. Verify the offer for the pool’s OS SKU and region.
Ubuntu. Microsoft’s bulletin lists all then-supported Ubuntu node images as affected. On November 6 an AKS maintainer confirmed interim image 202610.30.1. Microsoft’s manifests list kernel package 5.15.0-1126.135 for Ubuntu 22.04 Gen1 and 6.8.0-1073.82 for Ubuntu 24.04 Gen2. Confirm the exact SKU and regional offer. The interim image uses proposed Ubuntu packages and excludes Ubuntu FIPS kernels and the Kata Gen2 guest kernel. Microsoft tentatively expects the VHD with the official Ubuntu fix after November 15.
Exposure and scores. Microsoft calls out remotely reachable Multipath TCP listeners for CVE-2026-98432, an IPv4 TCP connection setup use-after-free with potential root code execution. Canonical describes the underlying flaw in standard IPv4 TCP handshake code as well, so check reachable IPv4 listeners before ruling out exposure. CVE-2026-99999 involves local or untrusted guest packet processing with malformed checksum metadata and can affect the host. Canonical publishes CVSS v3.1 scores of 9.8 Critical and 9.3 Critical respectively. Microsoft’s AKS bulletin gives no separate score.
The Microsoft and Canonical sources reviewed give no confirmation of active exploitation in AKS. Neither CVE appears in the current full CISA KEV snapshot, so there is no KEV federal deadline for either. The AKS bulletin gives no CVE-specific compromise-check or credential-rotation instruction.
MSP rollout
- Inventory every Linux node pool by OS SKU, region, current image, running kernel and upgrade channel. Check IPv4 listener reachability and guest or sandbox paths.
- Prioritize exposed listeners and pools that run untrusted workloads. Where patching is pending, restrict unnecessary ingress and assess workload placement. Canonical’s IPv4 option filtering can reduce risk for CVE-2026-98432 on covered paths, with separate handling for container network namespaces. It gives no complete protection.
- Stage the supported Azure Linux node-image upgrade, then roll affected pools. For Ubuntu, use the verified interim image where offered for the matching SKU, then track the official fix. Handle FIPS and Kata Gen2 separately.
- Verify the node image and running kernel on every node after the rollout. Check pod rescheduling, application health and any expected network controls.
Microsoft AKS-2026-0007 · Microsoft node-image upgrade guidance · Canonical CVE-2026-98432 · Canonical CVE-2026-99999 · AKS maintainer confirmation · Ubuntu 22.04 Gen1 manifest · Ubuntu 24.04 Gen2 manifest · CISA official KEV data