Is the campaign still active?

No. Active tracking ended Nov 3, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.

What evidence supports this record?

The record cites 6 primary sources, names 2 reviewed artifacts, and was last fully reviewed Nov 3, 2026 by HOL Guard Security Publishing. Its uncertainty and limitations are stated on the record itself.

How can this record be cited or exported?

The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. Docker has not published how 4.98.0 closes the gap or why it depends on WSL 3.0.3. HOL notes that the WSL kernel 6.18.54.1 release notes list BPF LSM enabled by default, which is HOL's reading and not a Docker statement.

critical severityConfidence highHistorical record

Docker Desktop for Windows on WSL 2: a container can slip past the AF_VSOCK block and reach host services and Windows files (CVE-2026-112917)

Q: What is the Docker Desktop for Windows on WSL 2: a container can slip past the AF_VSOCK block and reach host services and Windows files (CVE-2026-112917) campaign?

CVE-2026-112917 (CVSS 0 HOL Guard tracked the campaign from Nov 3, 2026 to Nov 3, 2026.

Direct answer

Docker Desktop for Windows on WSL 2: a container can slip past the AF_VSOCK block and reach host services and Windows files (CVE-2026-112917), also tracked as CVE-2026-112917 / Docker Desktop WSL2 AF_VSOCK bypass / Docker Desktop 32-bit socketcall seccomp bypass is a critical-severity threat campaign HOL Guard tracked from Nov 3, 2026 to Nov 3, 2026, verified against 6 primary sources and last reviewed Nov 3, 2026. Active tracking has ended and the record remains published as a permanent historical research record.

CVE-2026-112917 (CVSS 4.0 9.2 from Docker, CWE-424) was published on 2026-11-03 alongside Docker Desktop 4.98.0. In Docker Desktop for Windows with the WSL 2 backend, an unprivileged Linux container can use the 32-bit socketcall system call to bypass the default seccomp restriction on AF_VSOCK, which can expose host-facing services and Windows files accessible to the logged-in user. It affects x86-64 WSL 2; LinuxKit-based backends are unaffected. Docker says the issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later (released 2026-10-09 with WSL kernel 6.18.54.1); Docker Desktop 4.98.0 on an older WSL remains affected. The upstream moby default seccomp profile allows socket() only for listed address families (AF_VSOCK, 40, is not listed) but allows socketcall with no argument filter and includes the 32-bit x86 sub-architecture. Not on CISA KEV and no known exploitation as of 2026-11-03.

Also tracked as CVE-2026-112917 · Docker Desktop WSL2 AF_VSOCK bypass · Docker Desktop 32-bit socketcall seccomp bypass · Docker Desktop 4.98.0 security fix

First observed: Nov 3, 2026
Last observed: Nov 3, 2026
Last reviewed: Nov 3, 2026
Tracking ended: Nov 3, 2026

Record exports

JSON record Artifact CSV STIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

Docker has not published how 4.98.0 closes the gap or why it depends on WSL 3.0.3. HOL notes that the WSL kernel 6.18.54.1 release notes list BPF LSM enabled by default, which is HOL's reading and not a Docker statement. The seccomp analysis uses the upstream moby default profile; Docker Desktop's shipped profile was not inspected separately. NVD analysis is pending (status Received).

Docker Desktop on Mac and Linux is not affected; the record names Docker Desktop for Windows with the WSL 2 backend only.
LinuxKit-based backends (for example the Hyper-V backend on Windows) are unaffected per Docker.
Windows on ARM is outside the record, which says the issue affects x86-64 WSL 2.
Docker Engine on Linux servers and CI runners is not named in the record or release notes.
Exploitation requires code already running inside a Linux container on the Windows machine; it is not remotely triggerable on its own.

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

Not covered, or partially covered

not covered
HOL Guard reviews AI coding agent actions before they run. It does not enforce container isolation or patch Docker Desktop or WSL; the fix is updating both.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controls Campaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

Oct 6, 2026Vendor action
Microsoft releases WSL2 Linux kernel 6.18.54.1 (BPF LSM enabled by default per release notes).
Source:WSL2 Linux kernel linux-msft-wsl-6.18.54.1 release
Oct 9, 2026Vendor action
Microsoft releases WSL 3.0.3, which updates the bundled kernel to 6.18.54.1.
Source:Microsoft WSL 3.0.3 release
Nov 3, 2026Vendor action
Docker releases Docker Desktop 4.98.0, fixing CVE-2026-112917 where a container on the WSL 2 backend could bypass the AF_VSOCK restriction; requires WSL 3.0.3 or later.
Source:Docker Desktop 4.98.0 release notes
Nov 3, 2026Disclosure
CVE-2026-112917 published by Docker (CVSS 4.0 9.2, CWE-424).
Source:NVD CVE-2026-112917
Nov 3, 2026Update
HOL Guard publishes an operator write-up with the two-version check, wsl --shutdown step, seccomp socketcall analysis and scope notes.
Source:HOL: Docker Desktop on WSL 2 lets a container reach the Windows host (CVE-2026-112917)

Publication clock: 0.3 hours from reviewed disclosure timestamp to HOL publication; 12-hour critical target; within target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

Docker Desktop for Windows (WSL 2 backend, x86-64)@< 4.98.0, or >= 4.98.0 with WSL < 3.0.3genericpackage
Windows Subsystem for Linux (WSL)@< 3.0.3genericpackage

Sources

Every claim on this record is traceable to the sources below.

Campaign questions, answered

Reviewed in full by HOL Guard Security Publishing.

Published: November 3, 2026
Last full review: November 3, 2026
Last modified: November 3, 2026

Report a correction

Record HGTC-2026-43FB939B