One kernel build can fix several vulnerabilities and still be affected by another. Microsoft’s November 5 Azure Linux 3.0 bulletin revisions make that distinction important when planning a rollout.
What changed November 5, 2026
CVE-2026-98794 (MSRC first listed October 20, revised November 5 at 14:52 UTC). Microsoft rates the IPVS synchronization issue Critical, CVSS 3.1 9.1. Microsoft lists kernel 6.6.157.1-1 and 6.6.159.1-1 as affected and names 6.6.161.1-1 as the fix for the 6.6.159.1-1 row. The path requires an IPVS backup instance that receives synchronization traffic.
CVE-2026-99082 (MSRC first listed October 25, revised November 5 at 14:51 UTC). Microsoft rates the x86 KVM MMIO caching flaw Important, CVSS 3.1 8.8. The listed affected builds and new fixed-build row are the same as for IPVS. Check hosts running x86 KVM guests and the System Management Mode path.
CVE-2026-99246 (MSRC first listed and revised November 5, latest at 14:54 UTC). Microsoft rates the TIPC link-reset tracing race Important, CVSS 3.1 8.1. Microsoft names 6.6.161.1-1 as the fix for listed affected kernel 6.6.159.1-1. Check for TIPC use and node-reset tracing.
CVE-2026-99270 (MSRC first listed and revised November 5, latest at 14:55 UTC). Microsoft rates the TCP listener-migration use-after-free Important, CVSS 3.1 8.1. The revised bulletin lists both 6.6.159.1-1 and 6.6.161.1-1 as affected and leaves the fixed build blank. Check applications configured for TCP listener migration. The upstream fix needs an independently verified Azure Linux backport.
What to do
Suggested MSP priority. Promptly triage reachable IPVS synchronization and hosts running untrusted KVM guests. Inventory the Azure Linux release, installed RPM and running kernel. Check each feature before assigning exposure. Restrict IPVS synchronization to trusted peers and isolate untrusted guests where operationally feasible. Those steps reduce exposure while you verify the vendor-supported package.
Check the approved RPM repository or managed node image for a Microsoft-supported build with the relevant fixes. The public x86-64 base RPM index reviewed November 6 did not show 6.6.161.1-1. Validate availability for your architecture and image before rollout. Stage the upgrade, reboot or rotate nodes, verify the running kernel and test load balancing, guest health and application failover. Track CVE-2026-99270 separately in remediation records.
Last verified November 6, 2026. The reviewed MSRC rows provide no exploitation assessment. None of these four CVEs was listed in CISA KEV. No federal due date applies to these CVEs.
Microsoft October CVRF · Microsoft November CVRF · Microsoft x86-64 package index · Microsoft Azure Linux node upgrade guidance · Linux CVE team on IPVS · Linux CVE team on KVM · Linux CVE team on TIPC · Linux CVE team on TCP · CISA KEV