Live › vulnerability › CVE-2026-112917
In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use the 32-bit socketcall syscall to bypass the default seccomp block on AF_VSOCK sockets. An attacker in a container can reach host-facing services and Windows files readable by the logged-in user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 19:44 UTC. All times on this page are UTC.
Teams running Docker Desktop for Windows with the WSL2 backend on x86-64 machines, where developers or CI runners execute Linux containers. Machines using LinuxKit-based backends are stated to be unaffected. Docker Desktop 4.98.0 or later on an older WSL still remains affected, so both versions must be updated.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Docker Desktop (WSL 2 backend, Windows, x86-64) | vendor | < 4.98.0, or any version running WSL < 3.0.3 | 4.98.0 with WSL 3.0.3 |
4.98.0 or later AND WSL to 3.0.3 or later (wsl --update)s 4.98.0release notes: the AF_VSOCK bypass fixrequires WSL 3.0.3 or later'; 4.98.0 on an older WSL stays affected per the NVD descriptionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected.
This page as .md · .json · in your agent: get_signal("CVE-2026-112917")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.