Microsoft released Azure Sphere OS version 26.09 RC1 for evaluation, and while the release notes say there are no customer-facing changes, the headline here is the major Linux kernel version bump under the hood. Kernel upgrades in the IoT security world are a bigger deal than they sound.
Azure Sphere is Microsoft’s platform for securing IoT devices. It combines a custom Linux-based OS with built-in security services and a hardware root of trust on the chip level. The idea is that IoT devices running Azure Sphere get automatic security updates, certificate-based authentication, and a hardware-secured identity that can’t be tampered with. It runs on specialized microcontrollers with Microsoft’s Pluton security subsystem baked in.
The 26.09 release moves Azure Sphere to a newer Linux kernel baseline as part of Microsoft’s long-term support strategy. That means the OS gets a longer support window and access to newer kernel-level security features. For a platform that ships to devices that might sit in the field for years without physical access, this matters a lot.
Why the kernel version matters for IoT
Most IoT operating systems don’t see frequent kernel upgrades. Once a device ships with a particular kernel version, it often stays on that version for its entire life. This is a security problem because vulnerabilities in the Linux kernel are discovered and patched regularly. If your IoT platform can’t pick up those fixes, your devices are sitting on known exploits.
Azure Sphere’s update mechanism is designed to avoid this. Devices that are connected to the internet automatically receive OS updates from the cloud. The 26.09 RC1 evaluation feed lets device manufacturers test the new kernel against their applications before the update hits the production Retail feed. This two-week evaluation window is critical for catching compatibility issues before a mass rollout.
How the evaluation process works
The Retail Eval feed is a staging channel. You point a subset of your devices to this feed, they download and install 26.09 RC1, and you run your application tests against the new OS. If everything passes, you promote your devices to the Retail feed group when the production version drops. If something breaks, you have time to fix it before the update goes mandatory.
This matters because Azure Sphere OS updates are eventually enforced. Microsoft doesn’t let devices run indefinitely on unsupported OS versions. When your OS version reaches end of life, devices stop receiving security updates. The evaluation process is the safety net that keeps your production fleet on supported versions without surprises.
How Azure Sphere compares to other IoT security approaches
Compared to other IoT platforms, Azure Sphere’s approach is unusually opinionated. Most IoT Linux distributions give you a Linux kernel and let you figure out updates yourself. Some, like Ubuntu Core, offer snap-based updates. Others leave it entirely to the device manufacturer, which means many devices simply never update. Azure Sphere mandates automatic updates and enforces them at the platform level. You cannot ship an Azure Sphere device that ignores OS updates. That is restrictive if you are used to full control, but it is also the reason the platform can guarantee a security baseline.
The major kernel jump in 26.09 is meaningful because it shows Microsoft is investing in the platform’s long-term viability rather than just patching the old kernel. A stale kernel in an IoT platform is a ticking clock. Eventually, the CVE backlog catches up, and the patch surface becomes unmanageable. Moving to a newer baseline resets that clock and extends the platform’s safe operating window.
What this means for Azure Sphere developers
If you have devices in the field running Azure Sphere, the practical steps are straightforward. First, check the Azure Sphere OS release notes for version 26.09 and note the kernel version change. Then set up a test group using the Retail Eval feed and deploy 26.09 RC1 to it. Run your full test suite, paying attention to anything that touches kernel interfaces, device drivers, or low-level hardware access. If your application is well-behaved and doesn’t rely on kernel internals directly, the upgrade should be clean.
For teams planning new Azure Sphere deployments, starting on 26.09 from day one is the better choice. You get the longer support window and the newer kernel security fixes without having to schedule a migration later.
The bigger picture
Azure Sphere isn’t the most talked about part of Microsoft’s portfolio, but it fills a real gap. Every year, billions of IoT devices ship with minimal security, and many of them can never be updated after they leave the factory. Azure Sphere’s hardware-backed security model and mandatory update system address both problems, but only if the platform itself keeps its kernel current. Version 26.09’s kernel upgrade is one of those boring infrastructure improvements that matters more than any new feature could.
Version 26.09 may not ship with flashy new features, but the kernel upgrade underneath it keeps the platform viable for the years ahead, and that is the kind of update IoT security needs most.