by Kastro
Paper/Archive/CVE-2026-112917

CVE-2026-112917

Docker Docker Desktop — Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall

CVSS 9.2
critical.is priorityof 100
28
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected.

Affected

ProductAffectedFixed inSource
Docker Desktopsee advisory4.98.0CNA

Scores by source

Docker (CNA)9.2CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

References

refdocs.docker.com/desktop/release-notes/#4980refgithub.com/microsoft/WSL/releases/tag/3.0.3refgithub.com/microsoft/WSL2-Linux-Kernel/releases/tag/linux-msft-wsl-6.18.54.1