{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-43FB939B",
  "slug": "cve-2026-112917-docker-desktop-wsl2-vsock-isolation-bypass",
  "title": "Docker Desktop for Windows on WSL 2: a container can slip past the AF_VSOCK block and reach host services and Windows files (CVE-2026-112917)",
  "aliases": [
    "CVE-2026-112917",
    "Docker Desktop WSL2 AF_VSOCK bypass",
    "Docker Desktop 32-bit socketcall seccomp bypass",
    "Docker Desktop 4.98.0 security fix"
  ],
  "summary": "CVE-2026-112917 (CVSS 4.0 9.2 from Docker, CWE-424) was published on 2026-11-03 alongside Docker Desktop 4.98.0. In Docker Desktop for Windows with the WSL 2 backend, an unprivileged Linux container can use the 32-bit socketcall system call to bypass the default seccomp restriction on AF_VSOCK, which can expose host-facing services and Windows files accessible to the logged-in user. It affects x86-64 WSL 2; LinuxKit-based backends are unaffected. Docker says the issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later (released 2026-10-09 with WSL kernel 6.18.54.1); Docker Desktop 4.98.0 on an older WSL remains affected. The upstream moby default seccomp profile allows socket() only for listed address families (AF_VSOCK, 40, is not listed) but allows socketcall with no argument filter and includes the 32-bit x86 sub-architecture. Not on CISA KEV and no known exploitation as of 2026-11-03.",
  "status": "published",
  "severity": "critical",
  "confidence": "high",
  "uncertainty": "Docker has not published how 4.98.0 closes the gap or why it depends on WSL 3.0.3. HOL notes that the WSL kernel 6.18.54.1 release notes list BPF LSM enabled by default, which is HOL's reading and not a Docker statement. The seccomp analysis uses the upstream moby default profile; Docker Desktop's shipped profile was not inspected separately. NVD analysis is pending (status Received).",
  "firstObservedAt": "2026-11-03T19:17:53.000Z",
  "lastObservedAt": "2026-11-03T19:25:48.000Z",
  "publishedAt": "2026-11-03T19:38:14.890Z",
  "reviewedAt": "2026-11-03T19:38:06.666Z",
  "expiresAt": "2026-11-03T19:25:48.000Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "docker-rn",
      "label": "Docker Desktop 4.98.0 release notes",
      "url": "https://docs.docker.com/desktop/release-notes/#4980",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-11-03T00:00:00Z"
    },
    {
      "id": "nvd",
      "label": "NVD CVE-2026-112917",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112917",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-11-03T19:17:53Z"
    },
    {
      "id": "wsl-303",
      "label": "Microsoft WSL 3.0.3 release",
      "url": "https://github.com/microsoft/WSL/releases/tag/3.0.3",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-09T18:21:40Z"
    },
    {
      "id": "wsl-kernel",
      "label": "WSL2 Linux kernel linux-msft-wsl-6.18.54.1 release",
      "url": "https://github.com/microsoft/WSL2-Linux-Kernel/releases/tag/linux-msft-wsl-6.18.54.1",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-06T22:28:50Z"
    },
    {
      "id": "moby-seccomp",
      "label": "moby default seccomp profile",
      "url": "https://github.com/moby/profiles/blob/main/seccomp/default.json",
      "sourceType": "other_primary",
      "observedAt": "2026-11-03T19:25:48.000Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL: Docker Desktop on WSL 2 lets a container reach the Windows host (CVE-2026-112917)",
      "url": "https://hol.org/blog/cve-2026-112917-docker-desktop-wsl2-vsock-isolation-bypass",
      "sourceType": "other_primary",
      "observedAt": "2026-11-03T19:25:48Z"
    }
  ],
  "artifacts": [
    {
      "id": "docker-desktop-windows-wsl2",
      "artifactClass": "package",
      "ecosystem": "generic",
      "name": "Docker Desktop for Windows (WSL 2 backend, x86-64)",
      "version": "< 4.98.0, or >= 4.98.0 with WSL < 3.0.3",
      "defanged": false
    },
    {
      "id": "wsl",
      "artifactClass": "package",
      "ecosystem": "generic",
      "name": "Windows Subsystem for Linux (WSL)",
      "version": "< 3.0.3",
      "defanged": false
    }
  ],
  "indicators": [],
  "timeline": [
    {
      "id": "wsl-kernel-6-18-54-1-released",
      "occurredAt": "2026-10-06T22:28:50.000Z",
      "eventType": "vendor_action",
      "summary": "Microsoft releases WSL2 Linux kernel 6.18.54.1 (BPF LSM enabled by default per release notes).",
      "sourceIds": [
        "wsl-kernel"
      ]
    },
    {
      "id": "wsl-3-0-3-released",
      "occurredAt": "2026-10-09T18:21:40.000Z",
      "eventType": "vendor_action",
      "summary": "Microsoft releases WSL 3.0.3, which updates the bundled kernel to 6.18.54.1.",
      "sourceIds": [
        "wsl-303"
      ]
    },
    {
      "id": "docker-desktop-4-98-0-released",
      "occurredAt": "2026-11-03T00:00:00.000Z",
      "eventType": "vendor_action",
      "summary": "Docker releases Docker Desktop 4.98.0, fixing CVE-2026-112917 where a container on the WSL 2 backend could bypass the AF_VSOCK restriction; requires WSL 3.0.3 or later.",
      "sourceIds": [
        "docker-rn"
      ]
    },
    {
      "id": "cve-record-published",
      "occurredAt": "2026-11-03T19:17:53.000Z",
      "eventType": "disclosure",
      "summary": "CVE-2026-112917 published by Docker (CVSS 4.0 9.2, CWE-424).",
      "sourceIds": [
        "nvd"
      ]
    },
    {
      "id": "hol-blog-published",
      "occurredAt": "2026-11-03T19:25:48.000Z",
      "eventType": "other",
      "summary": "HOL Guard publishes an operator write-up with the two-version check, wsl --shutdown step, seccomp socketcall analysis and scope notes.",
      "sourceIds": [
        "hol-blog"
      ]
    }
  ],
  "coverage": [
    {
      "assertionId": "guard-not-container-runtime",
      "relationship": "not_covered",
      "limitation": "HOL Guard reviews AI coding agent actions before they run. It does not enforce container isolation or patch Docker Desktop or WSL; the fix is updating both."
    }
  ],
  "policies": [],
  "limitations": [
    "Docker Desktop on Mac and Linux is not affected; the record names Docker Desktop for Windows with the WSL 2 backend only.",
    "LinuxKit-based backends (for example the Hyper-V backend on Windows) are unaffected per Docker.",
    "Windows on ARM is outside the record, which says the issue affects x86-64 WSL 2.",
    "Docker Engine on Linux servers and CI runners is not named in the record or release notes.",
    "Exploitation requires code already running inside a Linux container on the Windows machine; it is not remotely triggerable on its own."
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-112917-docker-desktop-wsl2-vsock-isolation-bypass/corrections"
}