Azure Marketplace VM offer with a custom Linux image on kernel 4.4

A vendor-maintained Linux 4.4 kernel is not categorically barred, but approval cannot be confirmed from the version alone: submit it as a custom image, document its maintained patches and Azure driver backports, and obtain Microsoft’s case-specific certification approval.

Kernel 4.4 eligibility

The published policy does not establish a universal rule that rejects every 4.4 kernel. It requires Linux images to use minimum acceptable kernel versions with current security patches, contain no significant known vulnerabilities, and use a secure OS base. Custom images may undergo additional validation and require explicit Microsoft approval.^1^

For a vendor-maintained custom kernel:

• Keep current with security and maintenance patches.
• Backport current Linux Integration Services (LIS) fixes from upstream. Microsoft recommends a recent kernel and specifically tells vendors maintaining custom kernels to track and backport LIS fixes.^2^
• Include Azure-required Hyper-V functionality, including the relevant storage, networking, and VM bus drivers.
• Provide Microsoft with the exact kernel release/build identifier, patch manifest, supported lifecycle, vulnerability-scan results, and evidence that required Azure drivers and fixes are present.

Do not interpret the certification troubleshooting table’s 4.4.0-151 entry as general approval for any 4.4 kernel. That value applies specifically to Ubuntu 14.04 LTS verification for the SACK vulnerabilities CVE-2019-11477, CVE-2019-11478, and CVE-2019-11479. A separately maintained appliance kernel needs its own evidence and approval.^3^

Published validation performed on Linux images

Before submission, deploy the image in Azure and run the Certification Test Tool. Certification does not proceed when a required test fails; Microsoft also provides a VM Self-test Service API for pre-validation.^1^

The documented Linux toolkit checks include:^3^

• Image boots and reboots without a kernel panic.
• OS is 64-bit.
• Required kernel parameters are present:
  • x86-64: console=ttyS0 earlyprintk=ttyS0
  • Arm64: console=ttyAMA0 earlyprintk=ttyAMA0
• Minimum supported Azure Linux Agent is installed and automatic update is assessed.
• No swap partition exists on the OS disk.
• A single root partition is used.
• Bash history is cleared.
• OpenSSL and Python requirements are checked.
• SSH ClientAliveInterval is within the accepted range.
• DNS resolution and absence of pre-existing credentials are checked.
• The hv_netvsc network driver can be removed/reloaded and networking can recover; kernel panic or loss of SSH causes failure.
• The VHD is fixed, valid, correctly aligned, and contains a valid footer.
• The image is correctly generalized and provisions within the allowed time.

Security review also expects current distribution patches, a minimized attack surface, malware and vulnerability scanning, no default passwords or back doors, and removal of SSH keys, logs, certificates, and other sensitive material.^4^

A useful pre-submission kernel check is:

uname -a
cat /proc/cmdline
find /lib/modules/$(uname -r) -type f \
  \( -name 'hv_vmbus*' -o -name 'hv_storvsc*' \
     -o -name 'hv_netvsc*' -o -name 'hv_utils*' \)
dmesg | grep -Ei 'hyper-v|vmbus|storvsc|netvsc|panic'
waagent --version

Custom-image review and submission

The public documentation lists the standard tests, but it does not publish an exhaustive checklist for the additional case-specific review. Microsoft may request evidence beyond the toolkit results before approving a non-endorsed OS or custom kernel.

Prepare the following certification package:

1. Kernel source/version and reproducible build details.
2. Security-support lifecycle and patch cadence.
3. CVE report showing how vulnerabilities are fixed or otherwise mitigated.
4. Upstream LIS/Hyper-V patches included or backported.
5. Results from the Certification Test Tool, malware scan, and vulnerability scan.
6. Boot, reboot, provisioning, storage, networking, serial-console, and VM-extension test results across the VM generations and sizes offered.
7. Disclosure of intentionally included security-testing or exploit-like code to prevent malware-scan false positives.

If deployment requires a custom ARM template, select Requires custom ARM template for deployment on the Partner Center Technical configuration page so the certification team handles it as a custom deployment rather than failing standard provisioning.^3^

Therefore, Marketplace approval is possible in principle, but only Microsoft Certification Support can decide whether this particular vendor-maintained 4.4 build satisfies the current minimum-kernel, vulnerability, and Azure-compatibility requirements.

References

1. Microsoft Marketplace general listing and offer policies
2. Prepare Linux for imaging in Azure
3. Virtual machine certification troubleshooting for Microsoft Marketplace ...
4. Security recommendations for Azure Marketplace images